How can a system be configured to ignore gratuitous ARPs for specific IP addresses?

Static routing controls IP packet forwarding decisions and has no effect on ARP cache behavior or protection against gratuitous ARP-based poisoning attacks.

Hardcoding ARP entries creates static IP-to-MAC mappings that the operating system will not overwrite based on incoming ARP packets, including gratuitous ARPs. Because the entry is manually locked, an attacker cannot poison the ARP cache for those specific IP addresses by broadcasting spoofed ARP replies. This is a targeted mitigation for known critical hosts such as default gateways.

There is no standard 'arp -deny' command in Windows, Linux, or common network OS CLIs - this is a fabricated option.

DNS resolves hostnames to IP addresses at the application layer and does not replace ARP, which resolves IP addresses to MAC addresses at the data link layer - the two protocols serve entirely different purposes.