Use NAT DNS resolver (why not default?)