script: don't resolve AFTR since DNS won't be applied yet anyway