@ai6yr ACSC has that recommendation too, been in place for some years.

I've found it easiest to use a DNS sinkhole to do it, as that's provided the most bang / effort.
Pihole in my case.