> When some domain is always constantly resolved to your ISP, then that domain is owned by the ISP in your network. I think you've fundamentally misunderstood

> When some domain is always constantly resolved to your ISP, then that domain is owned by the ISP in your network. I think you've fundamentally misunderstood the problem. Nobody here is talking about the domain resolving to ISP. We're talking about an MITM attack where a middle-man (doesn't even need to be the ISP, it could be a router in the middle acting like middle-man) intercepts our request and serving its own public key instead of the actual server's public key so that it can carry out an MITM attack. With TOFU, there is no way to detect this attack the first time I am connecting to the website. Once you have foolishly trusted the middle-man's public key, you may not notice any problem for months or years. Then one day, the middle-man may decide to misuse your credentials that it has collected during MITM attack.