Mmastodon TechnologyCybersecurity first seen 15 h ago, last 15 h ago, peak #8

Users report ISPs silently hijacking DNS traffic

Original: When your ISP is actively hostile… Plain DNS to router: empty answer. Plain DNS to 9.9.9.9: still empty. Same query over

A network user found that plain DNS queries, both to their router and to Quad9's 9.9.9.9 resolver, returned empty answers, while the same query over encrypted DNS-over-TLS resolved correctly. The culprit: the internet provider was silently intercepting port 53 traffic and stripping records pointing to private RFC1918 address space, effectively rebinding protection applied without disclosure. The case has renewed debate about how far ISPs go in manipulating customers' name resolution without telling them.

Why now: It highlights how ISPs can secretly intercept and alter DNS traffic, which users can only detect by using encrypted DNS

Quad99.9.9.9DNS-over-TLSRFC1918ISPs

Open on mastodon →

Evidence

• When your ISP is actively hostile… Plain DNS to router: empty answer. Plain DNS to 9.9.9.9: still empty. Same query over DoT: resolves fine. The record points to RFC1918 space, so stripping it is textbook rebinding protection. Fine. But silently hijacking my port 53 traffic to… · roos@tooting.ch · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/4249482