Second gotcha.

My #hosts file was being ignored and I spent 2 hours trying every possible cause including file owner, charset, EOL character, permissions, etc etc, until I learned from this link https://iboysoft.com/tips/hosts-file-not-working-mac.html that #apple #systemintegrityprotection stops an edited hosts file being recognised.

Apple being stupidly unhelpful. Wouldn't be the first time.

So I did the csrutil disable in recovery mode and finally all is well, my hosts file is now blocking all kinds of shitty domains.