Normally this file is exempted from unveil by "pledge dns", but if the user has disabled pledge (which is required for using some features) it will no longer be exempted, so must be handled explicitly by unveil. Problem reported by Stefan Hagen, ok jcs landry