[tptacek]

Worth noting that an ISP that does this --- literally intercepting all port 53 traffic, TCP and UDP --- can just strip DNSSEC, too.