Running dig ANY target.com on a home internet connection usually results in a timeout. However, if you append @8.8.8.8 to query Google DNS directly, it works instantly.
Your ISP isn't broken. They block ANY queries by default to prevent a specific type of cyberattack called a DNS Amplification DDoS.
The Mechanics of the Attack
DNS queries normally use UDP, which means there is no handshake. Because there is no handshake, an attacker can easily fake (spoof) their IP address to look like a victim's IP.
The ANY tag tells a DNS server to return every single record it has (A, MX, TXT, etc.). This creates a massive payload discrepancy:
