You wouldn't typically do this with iptables you would use something like squid proxy with a suitable acl e.g.
acl OKSites dstdomain "/usr/local/etc/allowed-sites.squid"
# Add this at the top of the http_access section of squid.conf
http_access allow OKSites
http_access deny all
Where the allowed-sites.squid file contains a list of allowed sites
If you really must do this with iptables then
# deny everything
iptables -P OUTPUT DROP
# Allow DNS
iptables -I OUPUT -p udp --dport 53 -j ACCEPT
iptables -I OUTPUT -p tcp -d serverfault.com --dport 80 -j ACCEPT
iptables -I OUTPUT -p tcp -d stackoverflow.com --dport 80 -j ACCEPT
would allow access to DNS. Be aware that, using this method the IP address of the site is only updated when the rule is added to the filter. If the IP address of the site changes then access will be enabled agai so you'd need to reload the rules.