Was stuck with this error doing a casual activity:

Downloading android ndk...                                    curl --fail --retry 3 -o ndk.zip https://dl.google.com/android/repository/android-ndk-r23b-linux.zip                                              % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                Dload  Upload   Total   Spent    Left  Speed
 88  691M   88  609M    0     0  67.2M      0  0:00:10  0:00:09  0:00:01 63.9M          curl: (56) OpenSSL SSL_read: error:1408F119:SSL routines:ssl3_get_record:decryption fail
ed or bad record mac, errno 0

The error means the ssl stream has been mutated, possibly by a third party. Note: it's hard for me to believe that, I kind of just feel it as paranoid fear. I got it every time I tried the download, at about the same amount into the stream.

I think there are better solutions for routing, like cjdns or something, where connects are solid and prevent such things. Not set up with them.

$ host dl.google.com
dl.google.com has address 142.250.80.110        dl.google.com has IPv6 address 2607:f8b0:4006:80d::200e

I went on the web to get other information on the ip address of dl.google.com and ended up at whatismyipaddress.com, which also has host lookup.  It said the ip address was 142.250.72.238 . Since it starts with the same two numbers, I figured it was just some load balancing system.

$ cat /etc/resolv.conf
nameserver 8.8.8.8
nameserver 208.67.222.222
nameserver 1.1.1.1                                                  nameserver 84.200.69.80

I tried each nameserver in sequence like:
$ host dl.google.com 8.8.8.8
for each one.

The first three gave the same ip address that fails for me, each request, which seems strange to me for a load balancing system. The fourth gave a different ip address. I have 172.217.19.238 in my scrollback history but presently am getting 142.251.36.14 .

I moved this nameserver to the top of my list and the download finally completed successfully. This could be a coincidence, but didn't seem one at the time.