All of their services and ad networks use the "regular" names (like youtube.com and google-analytics.com) for these services and webpages, so any browser or mob

All of their services and ad networks use the "regular" names (like youtube.com and google-analytics.com) for these services and webpages, so any browser or mobile device will be looking up IPs via those names. And it's not like they're using CNAMEs that point to mixed-in names either. You can block them selectively using proxies without issue. As far as 1e100.net goes, I'm not sure where that would be applicable or why it's an issue. Now, if you're looking to do that kind of selective blocking at the IP/netblock layer... good luck. That's a nearly impossible task since large network service providers like Google have so many network spaces coming and going and can move around their services as demand dictates. It's a core competency. And that wouldn't matter whether they were all part of one domain or all kept separate. Unless your strategy was to work out which netblocks each business unit's domains were authoratitive for on reverse lookup and then blocking all of that. But that's ... making a lot of assumptions.