So a realtime whois lookup is performed when the request to the DNS server is made, and if the domain was only registered within X days/weeks, then return 0.0.0.0 (or other such blocking method).

See, I've outbuilding tried compiling lists of newly registered domains to use as block lists, bit they're very large lists that my under-spec systems struggle to deal with. As such, I scaled back / shelved the project.

Looks like Adguard DNS and NextDNS offer blocking NRDs as an option in their paid services. I shall be looking into this further.