2026 ISP DNS Report: Which Internet Providers Intercept Your Queries?
Analysis of 109,644 resolvers across 240 countries —
Key Findings
- NXDOMAIN hijacking affects 1.8% of live resolvers globally. Out of 30,682 servers that passed our probes, 551 redirect non-existent domain queries to their own servers instead of returning a proper NXDOMAIN error. This practice exposes users to tracking, ad injection, and broken application behaviour.
- DNSSEC adoption stands at 140.6%. 43,150 out of 109,644 tested resolvers validate DNSSEC signatures. The highest adoption rates are in Bangladesh (98.5%), Canada (96.2%), and the United States (94.4%). Africa and Central Asia lag behind with single-digit validation rates in many countries.
- 99 countries have at least one hijacking resolver. The highest absolute numbers of hijacking resolvers are in the United States (175), Cambodia (25), Egypt (23), and the British Virgin Islands (20). However, the hijacking rate relative to total servers is highest in smaller networks with concentrated infrastructure.
- Public DNS providers vastly outperform ISP defaults. The global average reliability for all tested resolvers is 85.4%. By comparison, well-known public providers like Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9) maintain 99.9%+ reliability with DNSSEC validation and zero NXDOMAIN hijacking.
- The situation is improving year-over-year. DNSSEC adoption continues to rise as major resolver software defaults to validation-enabled configurations. However, NXDOMAIN hijacking persists primarily among smaller regional ISPs and hosting providers that monetise failed lookups through search redirect pages.
Country Breakdown
The table below shows DNS server behaviour by country. Click any column header to sort. Only countries with 10 or more live-tested servers are included.
| Country | Servers | Hijack % | DNSSEC % | Avg Reliability | Verdict |
|---|---|---|---|---|---|
| United States | 9,442 | 0.9% | 95.8% | 95.6% | Good |
| France | 1,623 | 0.5% | 93.3% | 95.3% | Good |
| Russia | 1,290 | 0.4% | 48.4% | 93.4% | Good |
| Germany | 1,282 | 0.4% | 92.7% | 95.4% | Good |
| XX | 1,099 | 0.6% | 99.4% | 93.6% | Good |
| Canada | 1,024 | 0.5% | 95.9% | 95.4% | Good |
| United Kingdom | 944 | 0.3% | 94.4% | 95.1% | Good |
| Netherlands | 691 | 0.4% | 96.7% | 95.3% | Good |
| Bangladesh | 671 | 0% | 98.5% | 94.2% | Good |
| Brazil | 569 | 0.7% | 90.3% | 94.4% | Good |
| South Africa | 508 | 0% | 94.9% | 93.2% | Good |
| Singapore | 507 | 1% | 83.8% | 95.7% | Good |
| Mexico | 419 | 0.5% | 88.8% | 94.1% | Good |
| Poland | 389 | 0.3% | 78.7% | 94.2% | Good |
| Colombia | 371 | 0% | 80.9% | 93.6% | Good |
| Sweden | 352 | 2.6% | 95.5% | 95.3% | Mixed |
| Japan | 324 | 0% | 77.8% | 95.4% | Good |
| Australia | 317 | 0.6% | 90.5% | 95.2% | Good |
| Switzerland | 311 | 3.9% | 89.4% | 95% | Mixed |
| India | 302 | 0% | 78.5% | 94.6% | Good |
| Ecuador | 274 | 0% | 96% | 93.7% | Good |
| Hong Kong | 264 | 4.9% | 80.7% | 94.8% | Mixed |
| Italy | 255 | 0% | 87.5% | 94.5% | Good |
| Indonesia | 251 | 0.4% | 83.3% | 92.7% | Good |
| South Korea | 227 | 2.6% | 50.2% | 95.4% | Mixed |
| Spain | 191 | 0% | 79.1% | 94.2% | Good |
| Philippines | 191 | 0% | 33% | 95% | Good |
| Ukraine | 186 | 0.5% | 80.6% | 93.1% | Good |
| Argentina | 157 | 0.6% | 89.2% | 92.8% | Good |
| Czechia | 157 | 0% | 91.1% | 94.7% | Good |
| Peru | 154 | 0% | 71.4% | 93.5% | Good |
| Finland | 150 | 0% | 96% | 95.4% | Good |
| Dominican Republic | 144 | 0% | 98.6% | 94.3% | Good |
| Thailand | 141 | 0% | 63.8% | 94.7% | Good |
| Cambodia | 131 | 13% | 25.2% | 91.5% | Poor |
| Greece | 129 | 0% | 88.4% | 91.9% | Good |
| Guatemala | 111 | 0.9% | 76.6% | 92.7% | Good |
| Myanmar | 103 | 3.9% | 24.3% | 92.3% | Mixed |
| Uganda | 103 | 8.7% | 23.3% | 92.6% | Poor |
| Bulgaria | 97 | 0% | 64.9% | 93.7% | Good |
Data reflects probe results as of March 2026. ISP-level breakdowns available on individual country pages.
What is NXDOMAIN Hijacking?
When you type a web address that does not exist — a misspelled domain, a removed website, or an internal hostname — your DNS resolver should return an NXDOMAIN (Non-Existent Domain) response. This tells your browser, email client, or application that the domain genuinely does not exist, allowing it to handle the error appropriately.
NXDOMAIN hijacking occurs when an ISP or resolver operator intercepts this error response and replaces it with an IP address pointing to their own server. Instead of seeing a browser error page, you are redirected to a search page filled with advertisements, often operated by the ISP or a third-party monetisation partner. This breaks application behaviour, leaks your browsing intent to the ISP, and can interfere with security software, email validation, and internal network services that rely on proper NXDOMAIN responses.
Methodology
PublicDNS.info maintains a database of 109,644 DNS resolver IP addresses discovered through a combination of BGP routing data analysis, passive DNS observation, public resolver lists, and network scanning. Every resolver is probed on a 72-hour cycle by our automated infrastructure.
Each probe sends a standard A-record query to verify the resolver is responsive, then queries a guaranteed non-existent random domain to test for NXDOMAIN hijacking. If the resolver returns an A record instead of NXDOMAIN, it is flagged as a hijacker. DNSSEC validation is tested by querying dnssec-failed.org, a domain with an intentionally broken DNSSEC chain — resolvers that validate DNSSEC return SERVFAIL, while non-validating resolvers return the record.
Limitations: Resolver behaviour may vary under load or for specific query types. Some resolvers may apply hijacking selectively. IPv6 resolver coverage is thinner than IPv4. Reliability scores use an exponential moving average and may not reflect very recent changes. Our probe infrastructure is located in Europe, which affects latency measurements.
Recommendations
For consumers
If your ISP hijacks NXDOMAIN responses, switch to a public DNS provider that respects standards:
- Cloudflare DNS (1.1.1.1 / 1.0.0.1) — fastest, no-log policy, DNSSEC, DoH/DoT
- Quad9 (9.9.9.9 / 149.112.112.112) — security-focused, blocks malicious domains, DNSSEC
- Google Public DNS (8.8.8.8 / 8.8.4.4) — reliable, global anycast, DNSSEC
Use our DNS Privacy Check to test if your current DNS hijacks queries, and our DNS Benchmark to find the fastest option for your location.
For ISPs
ISPs that have corrected NXDOMAIN hijacking behaviour or wish to submit resolver data for inclusion in our directory can reach us via our contact page.
For researchers
Summary probe data is available for academic and journalistic use. Contact us for data access details. Individual resolver status can be queried via our server check API.
Share & Cite This Report
PublicDNS.info. "2026 ISP DNS Report: NXDOMAIN Hijacking & Privacy Across 109,644 Resolvers." March 2026. https://publicdns.info/reports/isp-dns-report-2026.html