domain name blacklisting

Interesting that you mention the nsswitch approach. I've played with that some time ago and in the end it was easier to configure dnsmasq to accept multiple hosts files than to implement the getXXbyYY callbacks in a nss module. In retrospect I think that NSS is the wrong level to solve it. The resolver approach builds on top of working code (it has to parse hosts anyway), may do caching and shares the configuration.