I have mine set to `NEVER` [wake for network access] and yet it still makes DNS requests often while asleep.

Curiously, it is able to maintain network connection even through the 1/4" steel of the safe it's stored within. The older Intel MBP doesn't and cannot.