Or use the DNSCrypt proxy. It has a module to filter DNS responses based on their name (full name or using expressions such as <i>sex</i>), or on the IP addresses they resolve to.
Instead of returning 127.0.0.1, which can make you vulnerable to rebinding attacks, it returns responses with the standard &quot;REFUSED&quot; response code.
<a href="https:&#x2F;&#x2F;simplednscrypt.org" rel="nofollow">https:&#x2F;&#x2F;simplednscrypt.org</a>
<a href="https:&#x2F;&#x2F;dnscrypt.org" rel="nofollow">https:&#x2F;&#x2F;dnscrypt.org</a>