What do you know, I tried, and found it to be impossible. You cannot block msn.com at the DNS level, not inside Windows anyway. It's been discussed and everything:

https://seclists.org/fulldisclosure/2006/Apr/509 [RE: Microsoft DNS resolver: deliberately sabotaged hosts-file lookup]

So the only answer is, as pointed out, a pihole or similar outside approach.