I am using an Indian ISP, one that is notorious for DNS hijacking and script injection (BSNL). I have my router set to use Cloudflare's Family DNS. But despite this, every time I attempt to access a website that I have not accessed recently, my ISP intercepts the first request and I get diverted to an ad from the ISP. Reloading the page will result in it going through.
As far as I can understand, what is happening is that the DNS results for websites I haven't accessed recently will not be cached, and hence the ISP is intercepting the DNS request and diverting it to the ad. But how are they able to do this when the DNS request should be going to Cloudflare and not to them?