My ISP seems to be MITMing dns queries, can somene explain how they do it, technically

Question

I hit this because raw.githubusercontent.com seems to have been blocked in my country with DNS servers 8.8.8.8 or 1.1.1.1 it gets resolved to 202.83.21.15, this is an ip of my ISP and not raw.githubusercontent.com

$ dig +dnssec @8.8.8.8 raw.githubusercontent.com 

; <<>> DiG 9.18.10 <<>> +dnssec @8.8.8.8 raw.githubusercontent.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33984
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;raw.githubusercontent.com.     IN      A

;; ANSWER SECTION:
raw.githubusercontent.com. 10   IN      A       202.83.21.15

;; Query time: 0 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Fri Jan 06 11:00:10 IST 2023
;; MSG SIZE  rcvd: 84

Whois of the wrong IP

whois -H 202.83.21.15
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '202.83.21.0 - 202.83.21.254'

% Abuse contact for '202.83.21.0 - 202.83.21.254' is '[email protected]'

inetnum:        202.83.21.0 - 202.83.21.254
netname:        CableLite
descr:          Broad Band Internet Service Provider, India
country:        IN
geoloc:         12.984080 77.579818
admin-c:        IA145-AP
tech-c:         IT120-AP
abuse-c:        AC1823-AP
status:         ALLOCATED NON-PORTABLE
mnt-by:         MAINT-IN-ACT
mnt-irt:        IRT-CABLELITE-IN
last-modified:  2021-01-15T11:13:16Z
source:         APNIC

irt:            IRT-CABLELITE-IN
address:        Atria Convergence Technologies Pvt Ltd
address:        # 1, 2nd Floor, Indian Express Building,
address:        Queen's Road, Bangalore - 560 001
e-mail:         [email protected]
abuse-mailbox:  [email protected]
admin-c:        IA145-AP
tech-c:         IT120-AP
....

Same website when i query over DoH I get the correct ip

curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=raw.githubusercontent.com&type=A' 2>/dev/null | jq .Answer[0]
{
  "name": "raw.githubusercontent.com",
  "type": 1,
  "TTL": 446,
  "data": "185.199.111.133"
}

Answer 1

how they do it, technically

The ability to define routes where to forward packets is the core function of routers, such as the ones that ISPs use. Normally an ISP's routers will learn all of their routes via BGP from other ISPs, but it's easy for the ISP to define a static route that forwards all packets for "8.8.8.8" in a different direction – such as to a local DNS server they've set up and assigned 8.8.8.8 as the IP address. (You can do this at home with ip route add.)

There are several other ways to do this; e.g. a router might support DNAT (ability to actually change the destination IP address on packets) – that's how "port forwarding" works in your home gateway, but the same kind of DNAT can be used by a router anywhere along the path to redirect packets meant for one IP address to another (e.g. rewriting "8.8.8.8" to "9.9.9.9").

Answer 2

As can be seen from your response, github.com doesn't use dnssec.

Thus, there is no authentication of the answer, and your ISP is free to reply what they want to the query.

This can either be done by you using their DNS servers, rewriting answers from other DNS servers, or diverting all DNS traffic to their DNS servers.