I'm throwing it the hosts blacklist as a file. For performance reasons I turn off reverse lookups and limit reloading to once every hour:

    (blacklist) {
      hosts /etc/hosts.blacklist {
        reload 3600s
        no_reverse
        fallthrough
      }
    }

    .:53 {
      import blacklist

      ... (more config)
    }