A SOC analyst is hardening the enterprise network against malware that relies on domain-generation algorithms (DGAs) to reach command-and-control infrastructure. The security team wants a network control that not only blocks resolution of known malicious domains but also automatically redirects the infected host's queries so that the compromised endpoints can be identified from the DNS resolver logs. Which network control best meets both requirements?