DNS-based filtering is easily circumvented. It already is being circumvented - today.
One of the dirty little secrets of the computing and networking industries I’m here to tell you is just how well-funded and how high-tech the porn industry is. Porn outfits are the bleeding-edge customers we in the computing/networking industry don’t like to talk about. But boy oh boy, do they buy equipment by the truckload.
If the government were to put up a free WiFi network, where you could be surfing porn anonymously anywhere, the porn industry would give their eyeteeth to make sure they capitalize on that access. They already use HTTP tunneling and proxy servers to circumvent DNS and HTTP filters/loggers that companies use to keep employees from surfing porn at work on a company’s network.
That’s what makes me so certain that your method won’t work: because the porn vendors are already circumventing exactly the approach you’re talking about and there already is a cat-and-mouse game going on between companies installing DNS logger/filters and HTTP filters and the porn vendors responding by burying their porn every deeper under tunnels, redirects, proxy servers, etc.
We're not talking about a perfect filter. Just one hard enough where the vast majority of users won't be able to get to it. So what if someone with ingenuity and some external software can go to a porn site. So what if they can call their friend on a web-chat and send pictures to each other?
Furthermore, if you're really wanting a neat trick, just have a whitelist that includes port-numbers to restrict access. Sure you couldn't even send an instant message over it, but it would be free and safe.