As for my take, I have a little shell script that translates hosts files into unbound configuration files, with always_nxdomain rules for each superdomain. I then use that unbound instance as my DNS.