A developer discovered their ISP was hijacking DNS queries and returning tampered IP addresses instead of legitimate results, detected when Cloudflare's DoH returned a different IP than other resolvers. The article explains how Unbound and other local DNS resolvers don't fully protect against this since they still use plaintext DNS for upstream queries. It also addresses common misconceptions from the viral tweet that prompted the writeup.
Background
DNS hijacking by ISPs is a well-known privacy and security issue where providers intercept and redirect DNS queries, often to serve ads or enforce censorship. This article adds practical detection methods and clarifies that local resolvers like Unbound alone do not solve the problem without encrypted DNS (DoH/DoT).
- Source
- Lobsters
- Published
- Nov 4, 2026 at 08:06 PM
- Score
- 7.0 / 10