A security analyst notices that several employees repeatedly attempt to visit newly registered domains that are hosting phishing kits and malware droppers. Management wants a solution that prevents workstations from resolving these known-bad domains before any connection is established, without requiring an agent on each endpoint. Which enterprise capability should the analyst implement?