net/dnscache: do not PreferGo on macOS/iOS

With this commit my iPhone can now DERP.

net/dnscache/dnscache.go

@@ -10,15 +10,27 @@
 	"context"
 	"fmt"
 	"net"
+	"runtime"
 	"sync"
 	"time"
 
 	"golang.org/x/sync/singleflight"
 )
 
-var single = &Resolver{
+var single = func() *Resolver {
-	Forward: &net.Resolver{PreferGo: true},
+	r := &Resolver{
-}
+		Forward: &net.Resolver{PreferGo: true},
+	}
+
+	// There does not appear to be a local resolver running
+	// on iOS, and NetworkExtension is good at isolating DNS.
+	// So do not use the Go resolver on macOS/iOS.
+	if runtime.GOOS == "darwin" {
+		r.Forward.PreferGo = false
+	}
+
+	return r
+}()
 
 // Get returns a caching Resolver singleton.
 func Get() *Resolver { return single }