Self-Hosted Main

Speaking from experience, companies that are trying to do this will typcially do it one of two ways: either through DNS lookups by having their on-network DNS server acting as a recursive server, thus being able to intercept/interpret DNS requests and apply filtering rules, OR through a forward proxy that all web traffic exiting the company network will go through. Forward proxies can absolutely be configured for SSL interception, and it's typically handled by using a company-issued certificate signed by the company's CA...and every company computer has the company's CA certificate installed, so it's explicitly trusted. This is why you shouldn't do any kind of personal business (especially banking) on company-owned devices.

The biggest difference between companies using a forward proxy and an attacker using DNS poisoning to redirect the traffic is intent - the attacker is doing it for explicitly malicious purposes, while the company is ostensibly doing it to enforce company policy (especially AUPs)...having access to all the delicious unencrypted data is simply a side effect. You trust your employer, don't you friend citizen?