> Today the ISP could, with a bunch of effort, re-route the traffic Injecting a route into your IGP is pretty trivial, any ISP with an engineer with more than

> Today the ISP could, with a bunch of effort, re-route the traffic Injecting a route into your IGP is pretty trivial, any ISP with an engineer with more than 6 month's experience could manage this. > though I haven't seen any evidence that any of them do that Unless you've actually looked, and performed pcap analysis of what your dns request/response looks like to try and determine if your ISP is intercepting, you can't be sure. That said, several ISPs used to do this quite transparently (pun not intended) in the early 2000s, to return advertising pages whenever a DNS query failed. Some of them would do this on their own DNS servers (that were the default pushed to your CPE, which was then the default for your network), some of them would actually hijack anything going to udp/53. This used to be prevalent for a while. Then again, who's making more money monetising your activity? Your ISP or Google? Given that your ISP can already see every IP you visit and how much traffic you exchange with that counterparty, who would you rather protect your DNS requests from? Them or Google?