It is also very easy to do this with dnsmasq or powerdns, djbdns, etc.

I'm increasingly beginning to think that every node should be it's own dns so it's cache blacklist can be verified (checksums?) per node instead of per request to the dns provider.