Run your own recurive DNS server (e.g. dnscache) on 127.0.0.1.
Alternatively, query authoritative servers directly. Use a port other than 53 if you really think your ISP is trying to filter your outgoing queries; I sincerely doubt they would bother.
192.5.6.30 is an authoritative .com server. Memorize that number.
dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @192.5.6.30
The names on the right of the "NS" rows are the authoritative servers for ycombinator.com. (Cloudflare. No comment.)
192.5.6.30 has the IP addresses for those. You'll find them in the "ADDITIONAL SECTION". Let's say it lists 1.2.3.4 as an IP address.
dig +norecurse -b0.0.0.0#5353 news.ycombinator.com @1.2.3.4
And you should receive the IP address for news.ycombinator.com, or at least your next clue where to look (if the DNS admin has chosen to play games with CNAME).
This method can be automated.
Your ISP is not "intercept[ing] all DNS requests". You are sending your requests to your ISP's recursive DNS servers (why?), and those servers are feeding you whatever information the ISP chooses. Go figure, they are sending you bogus info to inject advertising. Solution: Stop sending your requests to your ISP's recursive DNS servers (or any third party recursive DNS servers). Send your requests to your own recursive DNS server running on 127.0.0.1, or send nonrecursive requests to authoritative DNS servers only.
