> I have been thinking about incorporating similar thing for my unbound/nsd stack through client tagging

That's a nice idea, ping if you do get it working.

> How do you maintain the white list of domains for netflix/prime/disney+?

You can use any of existing whitelists for domains like this: https://raw.githubusercontent.com/JO2EY/Rules/master/Surge/R...

Domains for me are hardcoded, i recompile to change them (not ideal, i only did it to experiment and it's good enough so it stuck, also not much ram)

If things stop working I look at logs and update.

On other environments you could just present domains in a UI and have user block/allow/permanent block and hide. (that would be fine for me)

Thank you! I am currently using StevenBlack's host file for ad blocking across all DNS clients. The tagging setup is used as a split-horizon DNS; for example, my tiny tiny RSS domain gets resolved to 192.168.1.3 on my LAN and 10.1.2.3 for wireguard VPN clients.

I am using NixOS and consuming my own infrastructure definition, so the config is currently not portable, but I have been thinking about splitting it out into multiple files and publishing it.

I'm not seeing how this would help with these smart devices connecting automatically to mesh networks? (i.e. Amazon sidewalk 900mhz band).

It would not, but I deal with that threat differently - I don't buy such devices.

They won't necessarily disclose those devices have that ability upfront. Look at the Nest thermostat.