Noting this article skips over any discussion about why, or potentially (in the eyes of the law at least) legitimate reason an ISP might do this.

Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.

And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.

I am speaking here as the owner of a UK ISP (who does not currently do this).

For various reason, I also setup an Unbound who proxy to quad9 and is only accessible through DNS over HTTPS/QUIC and is behind a reverse proxy with auth (because being an open dns resolver on the internet is still a bad idea). This is nice because I can then have a dnsproxy or similar on my various devices, who all point to it and be pretty sure nothing can hijack my DNS queries. I also come with the benefit of forcing thing like a minimum TTL to avoid dumb services who decide to put a 10 seconds TTL to all their DNS entry...

AT&T in the US does this. Traditionally they did this so that failed lookups were routed to their search engine, which of course fed users ads.

My workplace is messing with DNS as well, probably to filter specific websites, and I would not mind it since for the context of my usage that is perfectly fair.

But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.

I have no idea how my coworkers seem to be so insensitive to it.

I fear a future where pretty much everything is trying to hack you or doing something which is indistinguishable from the meddling of a hostile actor.

I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.

Telecom Italia locks my DNS server (I cannot change it).

I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.

The trick is simple: disable DHCP on your router, and activate it on PIHole. As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.

Hardly a new thing.

Oh and btw, it's not "DNS Hijacking" it's a "Domain Helper", see: https://feross.org/shame-on-you-comcast/

The point of running a local unbound is indeed to turn on DNSsec validation. After that, it's the domains' fault for not using DNSsec. But at least your own stuff won't be tampered with, because you use DNSsec on your own domains, right? Right?

:-(

Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).

How is this not illegal... isn't what the ISP doing "hacking"?

Here is my self-documentation for home DNS setup: https://docs.zeropolis.net/doku.php/tech:homedns

Unlike OP, I have all my DNS route completely to my home DNS server, and only make changes to that container and my VM host during a "change window" meaning not during work hours. I block port 53 outbound entirely and have host entries for the two domains that my DNS server uses for DoH. If I had a better firewall on the edge, I would leave 53 open for my DNS container, but this workaround seems suitable enough for the home network.

Which ISP was doing this? It's worth calling out the bad actors.

I’m using NextDNS over https and frequently experience connection freezes with both Spectrum and T-Mobile. I don’t know what they’re trying to do, but I’m not happy with the way they’re trying to block basic services.

It's best to treat your ISP's DNS as not being in your best interest, and actively against you getting your full internet speed and responsiveness.

Set an external DNS server on your router, or learn to run your own locally.

> Although your regular internet traffic is encrypted with TLS, your ISP can see the hostname during the TLS handshake (SNI).

https://support.mozilla.org/en-US/kb/understand-encrypted-cl... not anymore, with many (not all) sites.

Deutsche Telekom did that too on my DSL line once, took some arguing to them suddenly 'do nothing' but it suddenly 'worked'

Sounds familiar to a Chinese

Reminds me of the Xfinity "Your personalized WiFi summary" emails. Despite returning their router, using a third party almost-layer-2 modem, my own openwrt router (with its own wifi, thank you very much), their emails seem spooky.

They have a counter of all of my devices, somehow (i mean... i guess their count is wrong, but it's infuriating that they try to keep track).

We need root DNS servers that support DoH/DoT.

my mobile network carrier blocks quad9

ISP can still see exit IP unless you VPN

Cloudflare Warp is handy, complete tunnel even if not as private as real VPN

since 80% of the web is on cloudflare it accidentally makes it faster anyway

and you don't have to use the cloudflare client, you can use Wireguard

Why not start by

1. contact the ISP and ask wtf they are doing

2. switch ISPs

Another reason to use a VPN you can trust, across your entire network and at all times.

Yum, screenshots of terminal windows, which is just text...

Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!

The story ended before it even started... What are the machine with the wrong IP doing? Is it just forwarding the request, or what is happening?