[3xblah]

With uBlock, is it possible to block all subdomains but allow a specific subdomain?

A resolver (e.g., unbound) is only one half of the DNS method I use. The other is an authoritative nameserver (e.g., nsd). For my own purposes, the resolver is optional.

[bscphil]

Yes, that's just this:

  ||example.org^
  @@www.example.org^

> The other is an authoritative nameserver (e.g., nsd). For my own purposes, the resolver is optional.

True, although I imagine for most people the nameserver part of it is the more optional. DNS ad blocking software tends to be a recursive resolver that returns 0.0.0.0 results for some unwanted domains. Unbound has the ability to do that (for the few domains I'm filtering entirely), and so I've stuck with that.

[3xblah]

It is no wonder that uBlock is so popular.

Not sure I understand returning 0.0.0.0. What if the user has some other servers listening.

I return the address of some server I control that is bound to a local address, e.g., an authoritative nameserver.

Compared to the available solutions this is way too much work for "most people", however from a purist perspective a self-managed DNS approach is not under the ultimate control of a browser-authoring, extension/app-approving company/organisation or some third party DNS provider.

Whether that even matters is debatable.

As long as these easy solutions keep working, there's no incentive to try a different approach.