I built a DNS resolver on Proxylity[1] as a demo but it didn’t occur to me that block by default was a use case. I might have to add that.

My suggestion: Allow by ASN would be a clean (simple) way to get all of Google, etc., allowed at once.

[1] https://github.com/proxylity/examples/tree/main/dns-filter