They were ordered to do both IP-level and DNS-based tampering. Any ISP will already have some IP-based blocking mechanism system in place for fending off opera

They were ordered to do both IP-level and DNS-based tampering. Any ISP will already have some IP-based blocking mechanism system in place for fending off operational emergencies such as DDoS. Router ACLs and null routes are common ways to do this. In fact ISPs in Finland are required to block SMTP traffic from residential customers by default (except to their own relay servers). The DNS side they probably had to improvise somehow, possibly by just configuring their own DNS servers as authoritative for the victim domains.