How does your ISP hijack an HTTPS connection? Are you using your ISP's DNS service?
DoH stands for DNS-over-HTTPS. You cannot hijack DoH without hijacking an HTTPS connection.
> they’re just going to get the recursive resolver from dhcp
In answer to my earlier question then, you're using your ISP's DoH DNS service, correct? If that's the case, there's no hijacking going on.
> People who bother to use something are the same ones who will tunnel traffic or run their own resolver.
This is the reason Firefox went with CloudFlare's DoH. Resisting ISPs' bullshit is much of the point.
Not true. An ISP can always reroute packets where ever they want. Want to reroute from a trusted resolver to your own, which is bootstrapped over regular DNS? No problem. Client checks it? No problem, it will fallback to regular DNS.
That's a good point, I'd missed that. I'd hope the browser would show a warning in this case though.
I don't imagine there'd be any point redirecting a DoH request rather than just blocking it outright though. No serious DoH implementation is going to fail to check the cert.