@codemonkeymike@fosstodon.org could use a separate pi-hole as a DNS server and filter using that. All DNS lookups would go through it. And you can put strict filters there, Its separate piece of equip the user has 0 access to. My 2 cents.