Even if DNS is redirected, where DNS lookup request goes to next depends on the next hop, which is – for the prevailing majority of the internet users – the ISP

Even if DNS is redirected, where DNS lookup request goes to next depends on the next hop, which is – for the prevailing majority of the internet users – the ISP. Deep packet inspection hardware appliances have proliferated in their numbers in recent years, they are cheap, the hardware is highly performant, and they are capable of the highly sustained throughput. Redirecting DNS queries in UDP port 53 to any other destination of choice is what they can do without blinking an eye (if they had one). Or dropping / blackholing it. Only a VPN tunnel can get through, however modern DPI appliances can also scan for VPN and VPN-like signatures in the traffic and drop those, too. The only viable and guaranteed to work solution to resist the tampering with the traffic is a VPN tunnel wrapped into a Shadow Socks tunnel that obfuscates traffic signatures and constantly changes ports it operates on to avoid detection.