Filtering for domains without CDN false positives

[KissT]

I been using domain based filtering with host alias and that worked just fine, but recently I see more and more shared endpoints, where unwanted and wanted domains are both point to the same CDN IP address, and hence looking for alternative approaches, I seen few options, but it does not feel like a clear cut, hence turning to the community for advise.

How would you filter domains on OPNSense firewalls in 2023 ?

[CJ]

Are you wanting to just block the domains or something else?

What about the DNSBL?