Suricata

I agree that having DNS Reputation would be valuable. It could be called "dnsrep" since it would be like iprep but for domain names.

Certainly it would inspect DNS requests. It could also be extended to look at the SNI field of TLS client requests and the HTTP Host header although I’m not convinced these are necessary. The nice thing is that these fields are already parsed out and normalized, and rules could be written (or programmatically generated) currently to identify traffic based off of domain names. However, this becomes onerous once you start dealing with a dynamic DNS blacklist of non-trivial size.

The DNS blacklist file should be just that -- a text file that Suricata reads and can reload quickly without significant internal effort. Reload should be able to be triggered via signal/socket/API call.

Since DNS blacklist matching involves multi-pattern match, Hyperscan could/should be utilized if available (although this would increase load/reload time since the Hyperscan database would have to be built/rebuilt but this is likely worth it given the frequency or reload; see below comment). Using Hyperscan as the MPM would also enable the powerful ability to use PCRE to match domain names, while maintaining performance.

I expect the frequency of dnsrep reloads in practice to be somewhere between a few times an hour to a few times a day, with the latter end of the spectrum being more likely.