They could even run under their own VPN and hook up the ads on their side... Ugh...
I've always wondered why Google doesn't provide that to its ad clients. Companies send their traffic to Google, Google puts the ads in, mixes it all up in one pot, sends it to the user in a way DNS filtering can't block without also blocking the content.