[dsr_]

It doesn't require special hardware. Anyone running their own resolving nameserver can do it with two parts:

include "/etc/bind/ad-blacklist";

/etc/cron.daily/update-ad-blacklist

or equivalent for unbound, maradns.... whatever.