I'm not sure if this is what you're looking for, but if you (or your customers) are willing to 'roll up your sleeves', take a look at this:

http://isc.sans.org/diary/DNS+Sinkhole+Parser+Script+Update/11818

Basically, you run an instance of the BIND DNS server, and the script automatically keeps it up-to-date with known-malicious domain names from a bunch of different sources.  It does not do site categorizations, though, so you can't permit/deny inappropriate sites (e.g. porn) that isn't malicious.

Even if you're not going to run the full instance of BIND, the script itself is a pretty interesting.