Ask HN: How to filter (whitelist) DNS lookups. Is there a way?

I want that DNS lookups of only whitelisted domains will go to external resolver.

My machine is configured with VPN. I want my machine block all DNS requests except for VPN server name. Or block on router before going out.

Could not find a solution either for Mac, Linux or a PF firewall rule for router ...