Is it possible to block certain domains on a client basis?

[AlphaJack]

I see an abnormal amount of queries coming from a device in the network:

domain	count
www.amazon.com	1393
www.microsoft.com	1384
www.yahoo.com	1382
avs-alexa-na.amazon.com	1382
accounts.google.com	72
www.googleapis.com	50

The first 3 websites should be accessible by smartphones and computers, but not to the specified client.

How can I achieve this? I am using static IPs within my LAN, so I know that the client IP won't change.

[lifenjoiner]

Sounds it is deployed on a router, and you have root access.
What about:

1. run 2 instances, one with strict blocking rules for the specified client,
2. using rules of iptables to forward requests from the specified client to the specified instance.

[AlphaJack]

The resolver is a normal device in the LAN, and unfortunately I don't have root access to my ISP router (and I don't even know if it uses iptables/nftables). I was hoping for a syntax similar to *.youtube.* @time-to-sleep, where I can configure a set of clients to further restrict their connection.

But yes, setting rules at the router level would be the most effective solution

[lifenjoiner]

Don't you run dnscrypt-proxy on the device? (Listening special ports needs root access on Linux AFAIK.)
Anyway, the controller I would suggest to be at:
Resolver device > client > MITM DNS forwarder device.
Depending whether you have the permission.

dnscrypt-proxy has time range base controlling as you know, but doesn't distinguish clients.

[AlphaJack]

Ok so you would suggest that on the resolver device I intercept and split the traffic using nftables, so I can hijack specific clients to a stricter instance of dnscrypt-proxy, which is listening on another port.

Thank you for the idea!