Source: I have been worked for an ISP and I was in charge of that.
To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else.
The solution, as another poster pointed out, was to use DNS-over-TLS.
That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding).
https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying
Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.
Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?
Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358
I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
If it isn't a shared IP, your own browser will block it because of a cert mismatch.
The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.