So you want:
- Something that enables you to only allow white-list based DNS resolution to 100 or more domains.
- Something that's point-n-click simple, or nearly so.
- Has to be free.
The answer is, in a word: NOPE.
Furthermore, know that using DNS as a method of locking down users will require you to restrict all DNS queries leaving your network. Queries will need to be only allowed out of your firewall if they are aimed at approved DNS servers. Doubly furthermore, users can simply edit their hosts file or use some kind of internal DNS server to circumvent that as well.
"My users aren't technical. They won't do that."
They might not be technical, but never underestimate the mental stamina of a person intent on checking their fantasy football brackets. Or porn. It's always porn. People go from "I FORGOT HOW TO COMPUTER" to "I'm haxen ur boxxen lol" before the workweek is out to get what they want.
"I've locked everything down and no one can mess with any setting that pertains to name resolution."
Well okay then. Make sure you attempt to falsify that statement. Preferably using a test subject under the age of 16 who wants to surf a torrent site.
Oh noes what do I do?!
In a choice between free, highly functional, and Fischer Price easy, you can have two. Maybe. My recommendation is to set up your own internal DNS server and make your own whitelist. Too technical? What you're asking is, by nature technical. Thus you either exchange currency for it or the sweat of your brow.
Parting notes: Make sure to block all outbound DNS queries except from that server you set up. Otherwise, stick to OpenDNS and see if you can raise the whitelist limit. $20 isn't much for the whole year. You could probably find that much change on the street. Hint: Check the sofas at shoe stores. Not that I've done that or anything.
Okay I have.