So my ISP was hijacking my DNS
Summary
The article documents a personal experience of ISP DNS hijacking and demonstrates how DNS queries can be tampered with even when using multiple resolvers. It explains why DNSSEC doesn’t encrypt traffic and outlines practical defenses (DoH/DoT, Unbound with forward zones, dnscrypt-proxy, and fallbacks) along with real-world setup considerations for homelabs. The piece also clarifies common misconceptions and discusses privacy implications and practical workarounds.