“That’s when I realised my ISP was hijacking my DNS queries and returning a tampered IP address.”
Plaintext queries to Google and Cloudflare came back with an address the ISP owned. Switching resolvers does nothing when the carrier answers for them. Only the encrypted lookup told the truth. DNSSEC would catch this, and the census cited here says 7% of domains have a working chain. The ISP goes unnamed, which is the one thing worth knowing.