> Some systems (like OS X) don't let Go make DNS requests directly.
I don't think this is a reasonable summary of the situation on OS X. That being that if you turn the firewall on and then turn on block of incoming connections on 10.11 and earlier, responses seem to get dropped. Characterizing that as a blanket disallowing of direct DNS requests is misleading. (I'm not defending OS X here, it's just that summaries like this turn into cargo cults.)
I don't think this is a reasonable summary of the situation on OS X. That being that if you turn the firewall on and then turn on block of incoming connections on 10.11 and earlier, responses seem to get dropped. Characterizing that as a blanket disallowing of direct DNS requests is misleading. (I'm not defending OS X here, it's just that summaries like this turn into cargo cults.)