Standard Domain Name System (DNS) resolution typically functions by sending plaintext queries—most commonly over UDP—to various servers to map human-readable domains to IP addresses. Because this data is not encrypted during transit, it is susceptible to interception. An individual user may discover this vulnerability when their network provider hijacks a request: instead of returning the actual destination server, the ISP provides its own IP address, effectively redirecting the user's connection.

A screenshot of a plaintext DNS query returning an IP address belonging to an ISP.
A plaintext DNS query being intercepted and redirected to an ISP-owned IP address.www.karthihegde.dev

This image illustrates the mechanism of DNS hijacking where a plaintext query is intercepted and redirected.

An IP ownership lookup showing the tampered address belongs to the ISP.
An IP ownership lookup confirming that the redirected address is owned by the service provider.www.karthihegde.dev

This visual provides evidence of the hijacking by showing the ownership of the returned IP address.

One method for ensuring data integrity is DNS Security Extensions (DNSSEC). However, many users mistake DNSSEC for encryption; it actually uses cryptographic signatures to verify that DNS records are authentic. If a domain owner has correctly implemented a valid chain of trust, any hijacked response will fail validation, causing the resolver to return an error rather than a fraudulent IP. The limitation here is adoption: as of late 2026, only about 7% of graded domains possess a fully validating DNSSEC chain. Without proper configuration from the domain owner, DNSSEC cannot prevent an ISP from tampering with the unencrypted traffic in transit.

To bypass ISP interference, users can employ local resolvers like Unbound or tools such as dnscrypt-proxy to facilitate DNS over TLS (DoT), DNS over HTTPS (DoH), or DNSCrypt. These protocols wrap the DNS query in an encrypted tunnel, preventing the ISP from snooping on or modifying the specific request content. While this secures the path between the user and the chosen resolver, it shifts the point of trust away from the ISP toward the third-party provider running those servers. Furthermore, even with encrypted DNS, ISPs may still identify visited sites via the Server Name Indication (SNI) during the subsequent TLS handshake unless all internet traffic is routed through a VPN.

A screenshot of a DNS query over Cloudflare's DoH endpoint returning the correct IP address.
A DNS query using DNS over HTTPS (DoH) successfully returning the authentic IP address.www.karthihegde.dev

This image demonstrates how encrypted transport protocols like DoH prevent tampering and return the correct data.