TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Developer Karthikey Hegde says he discovered that DNS lookups for a site returned an IP address associated with his ISP, while Cloudflare’s DNS-over-HTTPS service returned a different address. His account describes a personal troubleshooting finding, not independent confirmation of a broader ISP practice; the exact cause and scope remain unclear.
Developer Karthikey Hegde says he found that DNS lookups for a site returned an IP address associated with his internet service provider, while a query through Cloudflare’s DNS-over-HTTPS service returned a different address. His account describes a troubleshooting incident on his home network and raises questions about how DNS traffic can be observed or altered, but the supplied material does not independently verify the ISP’s role or explain why the responses differed.
Hegde said he began investigating after an external site used by a Podman container became unreachable almost immediately. He tested the domain with several DNS providers, including Google and Cloudflare, and said most returned the same IP address. A request to Cloudflare’s DoH endpoint, however, produced a different result. Hegde then checked the ownership of the first address and said it was associated with his ISP.
He interpreted that mismatch as evidence that his ISP was intercepting or changing DNS responses. The account does not include the domain name, the IP addresses, packet captures, repeated test results, or a response from the ISP. The observation is therefore attributable to Hegde, while the precise mechanism and intent behind the differing results remain unverified in the supplied material.
Hegde’s post also describes his current setup: AdGuard handles local DNS, while dnscrypt-proxy encrypts upstream queries using DNSCrypt. He says some containers have Cloudflare configured as a fallback resolver because he does not want a failure of his local DNS service to disrupt every container. This is his configuration, not a recommendation or a confirmation that it would prevent every form of DNS interference.
How DNS Choices Affect Privacy
The episode illustrates a practical distinction between a DNS lookup and the later connection to a website. Traditional DNS queries are often sent without encryption, allowing a network provider that carries them to observe the requested domain and potentially interfere with the response. If a resolver supplies an incorrect address, a user or application may fail to reach the intended service or could be directed elsewhere. Hegde’s report does not establish that such redirection occurred beyond the differing address he observed.
Encrypted DNS, including DNS over HTTPS (DoH), DNS over TLS (DoT) and DNSCrypt, protects the connection between a device or local resolver and the chosen upstream resolver. That can make queries harder for an ISP to read or alter while in transit. It does not remove the need to trust the resolver: the provider receiving the encrypted request can still see it and control the answer it returns.
The account also matters for people who self-host DNS. Running a resolver such as Unbound does not automatically encrypt the resolver’s own queries. Hegde explains that a resolver doing recursive lookups may contact multiple DNS servers using conventional, unencrypted DNS unless it is configured to forward requests through an encrypted connection. The protection depends on the actual configuration, not simply on running DNS software locally.
Products Worth Considering
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
DJI Mic 3 Wireless Microphone Kit (2 Transmitters, 1 Receiver, Charging Case)
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
As an affiliate, we earn on qualifying purchases.
What Hegde’s Tests Compared
DNS translates a domain name into an IP address that computers use to connect to a service. In a recursive setup, a resolver can seek an answer through the DNS hierarchy, contacting root, intermediate and authoritative servers. Those exchanges traditionally use plaintext DNS, often over UDP. A locally hosted resolver can also forward requests to another resolver rather than perform that process itself.
Hegde distinguishes encryption from DNSSEC, which uses digital signatures to let validating resolvers check whether DNS data is authentic and has not been altered. DNSSEC does not encrypt the query, so it does not hide it from an observer on the network. If a signed response is changed and validation fails, a validating resolver should reject it rather than return the altered data. That protection depends on the domain having a valid DNSSEC chain and on validation being performed.
Hegde cites an October 2026 Defaults.Exposed census, saying 7.03% of graded domains had a valid, fully validating DNSSEC chain. The supplied material provides no further detail about the census methodology or the meaning of “graded,” so the figure should be treated as his cited statistic rather than a measure of all domains. He also notes that DNS encryption does not make browsing invisible: an ISP may infer destinations from connection metadata, such as destination IP addresses or hostname information available during a TLS connection, depending on the protocol and setup.
“Almost all of them returned the same IP address. But as soon as I tried Cloudflare’s DoH endpoint, I got a completely different IP address.”
— Karthikey Hegde, describing the troubleshooting result
What the DNS Mismatch Cannot Prove
The source material does not identify the ISP, the domain, the returned IP addresses, or the date of the tests. It also does not provide logs or independent measurements that would show where the response changed. A difference between resolver results can prompt investigation, but the supplied account alone cannot establish whether the ISP deliberately altered a response, used a different DNS policy, or whether another factor affected the lookup.
It is also unclear whether the result persisted across repeated queries, networks or devices, or whether other customers saw the same behavior. Hegde’s interpretation is that his ISP hijacked DNS; no ISP comment or independent technical analysis is included in the source material. The reported finding should not be generalized into a claim that the provider or other ISPs routinely alter customer DNS responses.
Encrypted DNS changes which party can see a query; it does not guarantee that the chosen resolver gives a correct answer, and it does not conceal all information about a user’s later connections. Hegde’s account does not report a security compromise, identify a site reached through the suspect address, or establish that personal data was exposed.
Evidence Needed to Verify the Claim
Hegde’s post does not announce a formal investigation or describe further testing. To establish the cause, useful next steps would include publishing the queried domain and timestamp, preserving the competing DNS responses, and repeating the tests through different resolvers and network paths. Comparing the ISP’s resolver with an independent encrypted resolver and checking whether the answers match authoritative DNS data could help distinguish interception from other sources of variation.
A response from the ISP could clarify whether it operates DNS redirection, filtering or other query-handling systems. Until such evidence or a response is available, the account remains a single user’s reported observation, with the claimed ISP involvement unconfirmed by the material provided.
Key Questions
What did Karthikey Hegde report?
He said DNS lookups for a site returned one IP address through several providers, while Cloudflare’s DoH endpoint returned a different one. He traced the first address to his ISP and concluded that the ISP had altered his DNS traffic; the supplied material does not independently confirm that conclusion.
Does running Unbound prevent an ISP from seeing DNS queries?
Not by itself. A locally running Unbound resolver may make its own queries to DNS servers using unencrypted DNS. Encryption depends on how it is configured, such as forwarding queries to a resolver over an encrypted protocol.
Does DNSSEC encrypt DNS traffic?
No. DNSSEC uses signatures to let a validating resolver check DNS data. It does not conceal queries in transit, and validation depends on a valid chain of signatures for the domain.
Does DoH or DoT prevent all DNS tampering?
No. DoH and DoT encrypt the connection between the client or local resolver and the upstream DNS resolver, limiting what an ISP can read or alter on that path. The user still has to trust the resolver itself.
Can an ISP still tell which websites someone visits?
Potentially. Encrypted DNS does not hide all later connection metadata. An ISP may infer destinations from IP addresses or other information, depending on the site, connection protocol and any VPN or other tunneling service in use.
Source: karthihegde.dev
