Hacker News Reader

They will probably forward all DNS traffic to their own resolvers by just changing the destination IP of any UDP traffic to port 53.

This won't work with DNSSEC or encrypted DNS though.

View on HN

It'll work just fine with DNSSEC for the overwhelming majority of sites on the Internet, since virtually none of them are signed and DNSSEC doesn't actually encrypt traffic.

Encrypted DNS, though, like DoH or DNS-over-TLS or DNSCrypt, stops this cold.

The tldr section of the article says that's not the case.

It wasn't the case for me, however I'm not exactly sure how they've implemented this DNS hijacking and if I was just an exception or the rule. Other people using custom DNS seemed to have a similar experience from what I read on reddit though.

Reply on news.ycombinator.com