dnsmasq also has out-of-box support for adding DNS replies to ipset: the --ipset option.