[Willox]

My ISP in the UK actually modifies the result of any lookup of google.com/google.co.uk regardless of if I am using their DNS or not.

I don't think this specific example is malicious (it's part of Google's Edge Network I guess? I wouldn't know), but it does show that they're already capable of modifying the DNS lookups ran by their customers.

[fred256]

Google itself will return an edge node for google.com (or google.$TLD) if you're on an ISP with an edge node.

[nl]

Are you sure that's what happening?

I suspect you maybe seeing resolution to Google's edge network. This isn't modification - it is how DNS is designed to work.

[Willox]

What feature of DNS allows this? I'm probably wrong if that's the case.

Perhaps I'll check some other domains too.

[giovannibajo1]

https://tools.ietf.org/html/rfc7871

[nl]

That's an extension to let you use Google's DNS servers and still have CDNs work.

Without it the functionality described above will just work - it's only when you are using an unusual DNS setup that the extension is needed.

[moreati]

May I ask which ISP this is?

[djhworld]

what ISP are you with?

I'm with BT and they don't appear to do this.

[rahrahrah]

What ISP is this?