Hacker News Reader

You could catch and redirect all port 53 traffic to a local Pi-hole (or similar dns server) to respond with whatever you want

...and this is why there's a push for DNS over HTTPS/DNS over TLS

And I’m not sure which is worse here. Devices on my network I can’t control, or protocols so easily circumvented.

Which is why I rooted my TV, install my CA on it and forced it through my squid proxy that does SSL bumping.

My network, my rules.