So my ISP was hijacking my DNS

An author's debugging session unearths a troubling truth: their ISP is actively hijacking DNS queries, returning tampered IP addresses. This deep dive into DNS privacy, security protocols like DoH/DoT/DNSSEC, and practical home lab solutions resonates deeply with HN's technical audience, sparking a heated debate on ISP ethics, surveillance, and the quest for true internet freedom.

Score

Comments

#12

Highest Rank

on Front Page

First Seen

Nov 5, 5:00 AM

Last Seen

Nov 5, 3:00 PM

Rank Over Time

The Lowdown

While troubleshooting a homelab issue, the author, Karthikey Hegde, stumbled upon a startling discovery: their Internet Service Provider (ISP) was covertly redirecting DNS queries. Instead of providing the correct IP address for a specific domain, the ISP's DNS was returning an address that belonged to the ISP itself, effectively hijacking traffic. This led to a deeper investigation into how ISPs can manipulate internet traffic and what measures can be taken to prevent it.

The initial clue was a disparity between plaintext dig results (returning an ISP IP) and Cloudflare's DoH endpoint (returning the correct IP).
The article clarifies that self-hosting a DNS resolver like Unbound doesn't guarantee protection if its upstream queries are unencrypted.
DNSSEC, despite its name, provides validation of data integrity, not encryption, and its low adoption rate limits its effectiveness against this kind of tampering.
DoH (DNS over HTTPS) and DoT (DNS over TLS) encrypt the connection to the DNS resolver, preventing passive snooping and active tampering in transit, but still require trust in the chosen resolver.
It's noted that ISPs can still infer visited sites via TLS SNI (Server Name Indication) unless traffic is routed through a VPN.
The author shares their personal setup, which involves AdGuard Home for local DNS, dnscrypt-proxy for encrypted upstream queries, and Cloudflare as a fallback for critical containers.

Ultimately, the author's experience and detailed explanations serve as a stark reminder of the constant battle for digital privacy against powerful ISPs and the technical solutions available to those willing to implement them.

The Gossip

ISP Interference & Illegality Inquiry

Many commenters expressed outrage and questioned the legality of ISP DNS hijacking, with some speculating it's either a common, unethical practice or, in certain regions, legally mandated for censorship or blocking. Users shared personal experiences with similar ISP behaviors, including specific examples from India and the UK, and debated whether to name and shame 'bad actor' ISPs.

DNSSEC's Dilemma & DoT/DoH's Dominion

The discussion delved into DNSSEC's role and perceived shortcomings. While it offers validation, its lack of encryption and low adoption rate mean it's often insufficient against active tampering. Commenters highlighted real-world issues with DNSSEC breaking services and emphasized that DoT or DoH are the more effective, tamper-resistant solutions for encrypting DNS traffic, shifting the trust from the ISP to the chosen resolver.

Mitigating Meddling & VPN Virtues

Practical solutions to circumvent ISP DNS manipulation were a prominent theme. Users shared strategies like implementing Pi-hole as a DHCP server, configuring DoH in web browsers, and the overarching recommendation to use a trusted VPN for full traffic encryption, including DNS queries. The complexities of trust models with self-hosted vs. third-party VPNs were also debated.