Comment by aendruk

My ISP [1] actually does this. They offer an opt-out of NXDOMAIN hijacking, but silently proxy all port 53 traffic regardless.

This experience has taught me simply to distrust the DNS protocol in its current form and use DNSCrypt in all situations.

  [1]: Shaw Communications, chosen by the landlord.
  [2]: http://dnscrypt.org/