They MITM all DNS requests no matter the destination DNS server and hijack them. (Clarification: every ISP can. Some, but not all, actually do so.)