[XparentX]

Respect! Thanks for posting! Could you do a blog-post or more technical write up about your implementation.

I have my own DNS with min-ttl set. Further more I have firewalled all DNS-lookup except to a certain provider.

On top of this I have a installed a local CA on all devices.

Blocked domains are reverted to an local nginx that answer with a empty gif or 204, even when the request is on https (domains spoofed).

The access.log is very interesting to analyse, and sometimes you find bugs in iOS apps that crashes because they could not send their usage data to flurry.com or other domains.