[tquai]

Run your own resolver on 127.0.0.1, and your own authoritative nameserver on 127.0.53.1, and configure the resolver to ask the nameserver (returning NXDOMAIN) for

  * facebook.com
  * doubleclick.net
  * google-analytics.com
  * su (abuse)
  * 2o7.net
  * any others you want; get ideas from the MVPS hosts file

Since facebook domains (fbcdn.net, facebook.net, etc.) are all serviced by facebook.com nameservers, returning NXDOMAIN for *.facebook.com will thereby sabotage all facebook related queries. This way you won't have to play whack-a-mole with future facebook tracking hosts, so long as they use facebook.com nameservers.

Or hell, just create a list of prefixes announced & owned by AS32934, Facebook, and block all. Just to be sure.