They do MITM of custom DNS servers? Despicable! I wish DNSCrypt support was more widespread.

Yup, that's what it looks like. I just encountered it last week: https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe

Been meaning to try to dump some traffic so I can see more of what's going on.

That is pretty incredible. I knew about ISP's DNS servers that hijacked NXDOMAIN but I've never before heard of MITMing of third party DNS servers! Wow! Have you contacted T-Mobile about it?

Just FYI, I wrote this up (http://esd.io/blog/t-mobile-dns-hijack.html) and I'm told off the record that T-Mobile intends to fix it.

Awesome, thank you for going the extra mile and reaching out to T-Mobile! I hope they really do fix it. =)

I haven't, but that's a good idea. I'm guessing there are semi-legitimate reasons beyond just forcing people to the stupid NXDOMAIN search page. But I agree that it's pretty unpleasant.

comcast does/did the same.

This is really really bad.