How to Check If Your ISP Is Hijacking DNS (Switching to 1.1.1.1 Won't Fix It)
Karthikey Hegde's Podman container couldn't reach a site. Almost all of their plaintext lookups, through Google DNS, Cloudflare and others, returned the same IP, and that IP belonged to their ISP . Cloudflare's DoH endpoint returned the real address. So if a site won't load on your connection but works elsewhere, and a forum told you to set your DNS to 1.1.1.1 or 8.8.8.8, that advice may have…
If your internet service provider (ISP) is intercepting Domain Name System (DNS) requests, you may experience issues accessing certain websites, even after changing your DNS settings to a popular alternative like 1.1.1.1 or 8.8.8.8. This is because the ISP can modify the DNS responses before they reach your device. To determine if your ISP is tampering with your DNS, follow these steps.
First, identify the domain name that is causing issues for you. Do not use popular domains such as google.com, as an ISP may selectively block or modify DNS requests for these sites. Next, perform three tests using different methods to check if your DNS is being hijacked.
1. Perform a plaintext DNS query to several public resolvers (e.g., 1.1.1.1, 8.8.8.8, and 9.9.9.9) to see if they return the same IP address for your problematic domain. This can be done using the dig command in a terminal or command prompt. If the IP addresses returned are different, it may indicate that your ISP is interfering with the DNS responses.
2. Test the same domain using HTTPS (DoH) by sending a request to Cloudflare's DoH endpoint. This can be done using the curl command with the -H header to specify the accept: application/dns-json parameter. Compare the response from different resolvers. If the IPs returned differ, it could suggest ISP tampering.
3. Check the ownership of the IP address returned in step 1 by running a whois command on that IP. If the owner of the IP is your ISP, it strongly indicates that they are indeed hijacking your DNS. If the IP belongs to a CDN or the site's host, it is likely a geographical issue rather than ISP tampering. You can then run a certificate check to determine if the IP can serve the site over TLS. If it cannot, it further supports ISP tampering.
Interception can also be partial, with some ports (UDP) affected while others (TCP/IPv6) remain unaffected. Test both UDP and TCP/IPv6 using the appropriate dig commands. A mismatch in results could indicate potential tampering.
Finally, run the whoami.ds.akahelp.net DNSSEC test to see if your ISP is tampering with the path itself. This test can detect tampering on about 7% of domains signed with DNSSEC. If the result shows a mismatch, it strongly suggests that your ISP is indeed intercepting your DNS requests.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
