dnsmasq can be used for wildcard domain aliases in OPNsense firewall, https://github.com/opnsense/core/issues/4145#issuecomment-12...
1) blackholing every possible subdomain of business-i-dont-like.com, and 2) return a single IP address for any and all internal subdomains of a private domain - they all go to the same proxy then, and it's just one setting to set and forget.
(I may have completely misunderstood this feature though, and I would welcome correction)
The second should also work, though I've not used it (or considered it prior to reading your comment).