I have a large set of sites blocked at the router via dnsmasq, which scales well.

(It also means my unrooted mobile device ... doesn't have such protections when it's outside the Mothership.)