Right. Have a DNS servers which only forwards request to trusted domains, and a transparent proxy which only allows traffic to those same domains. This is not

Right. Have a DNS servers which only forwards request to trusted domains, and a transparent proxy which only allows traffic to those same domains. This is not a new idea at all, but it's still a very good one.