Would this system block websites at the IP level or at the DNS level? Doing it at the DNS level would mean you could roll your own DNS or use a non-US DNS prov

Would this system block websites at the IP level or at the DNS level? Doing it at the DNS level would mean you could roll your own DNS or use a non-US DNS provider. Doing it at the IP level would mean the ISP reverse-lookups IP addresses back into domain names and checking against a list of banned addresses. This one could only be bypassed through proxies.