htst would cause you problems. Browsers already know where to point traffic. The inner workings of its system is a bit unclear to me, but as this has to do with DNS record resolvement, we'll just stick to that instead, since your records aren't on an authoritative DNS, and google.ca is routed by whoever handles .ca domains to use their specified nameservers.
This would never work because the top level DNS servers that ARPA runs does not accept changes from your nameserver for a domain that they couldn't verify to be from said DNS pointed out via the .ca domain handlers routing. Therefore this would cause duplicates (not good; it could cause your domain to be revoked if they believe this was done on purpose), if the providers default nameservers handle redirection or pointing to its specified IP address.
It's a whole bunch of levels, and you have to be on the same level within its network (as the DNS record is hosted on) to carry this out and yes as someone mentioned, you would probably have to carry out DDoS attacks to force it to fallover, or some low-key hacking on the victims to use your rouge DNS.
To have its record overwritten, this could probably be done by firewall rules if the system had been compromised, again just guessing, but there could be other ways that doesn't require system access.
It's my understanding of this, there are people here with far more experience than what I have, and this is a very complicated visualisation of what is going on.
There could be several ways to bypass this for not-so-high-end domains not certified/verified for htst, but really this isn't something that should be talked about on the open web since performing this is considered basis for the worst type of cyber crime.
You would be able to use this to intercept, carrying out man in the middle sort of attacks on vulnerable domains using the same DNS as your website, just by using the same provider who also must be fairly outdated/insecure which there are plenty of.
The Internet is broken, and it's the whole reason why we have to mitigate all these faults by spending countless hours configuring even the simplest of services.
domain.something.
that last dot is indicating it's still a subdomain of whatever domain I'm editing records for. Are you sure you're not actually making records forgoogle.ca.mydomain.com
? – Logarr Feb 13 '20 at 15:52