While processing outbound DNS queries via 'flows' we may attempt to open a TLS connection to port 443 or a TCP or UDP connection to port 53 using the Network framework As far as we know these always succeed. From the stack trace it appears that the problem occurs when the NetworkExtension is attempting to set up an NEAppProxyUDPFlow before handing it to us. It is not clear what the connection is if any between that and what we are doing via the Network framework