(Full disclosure: I run a service that blocks and intercepts malware communication using DNS! <a href="https:&#x2F;&#x2F;strongarm.io" rel="nofollow">https:&#x2F;&#x2F;strongarm.io</a>)<p>Blocking via your hosts file has some great benefits; it works regardless of network and is relatively easy to update. Unfortunately, it doesn&#x27;t scale easily to many systems or give you any insight into whether or not you are trying to connect to blocked domains.<p>Blocking via DNS is a good alternative and is suggested multiple times in this thread. You can easily protect a whole network by setting your recursive resolvers and it works across any system.<p>If you are interested in this and don&#x27;t want to operate and maintain your own DNS (as well as pulling down various domain lists) check out <a href="https:&#x2F;&#x2F;strongarm.io" rel="nofollow">https:&#x2F;&#x2F;strongarm.io</a>. We manage DNS, aggregating lists of bad domains, and (most uniquely) will alert you if you try and talk to a blocked domain.<p>It&#x27;s free for personal use. We are a growing startup and love feedback from HN. Feel free to contact me directly as well! stephen[at]strongarm.io