To determine whether or not to perform DNS prefetch, the CFNet backend checks the system proxy settings once every five seconds to determine whether a proxy would be used to load http://example.com/ or https://example.com/; see platform/network/DNSResolveQueue.cpp and platform/network/cf/DNSCFNet.cpp. This is not ideal, since if a proxy is configured for only a particular domain, then WebKit could perform DNS prefetch for that domain, defeating the (privacy) purpose of having selected the proxy. It would be better if it were possible to ask the system if it's possible that a proxy could be used on *any* site, and if so, disable prefetch globally. (Checking proxy settings for every prefetch is probably undesirable as that could cause a performance regression.)
Another comment from Darin (from bug #145542): "This 5-second polling strategy is really strange on iOS and Mac. Surely there are notifications of changes in proxy status that we could take advantage of instead of using polling. Someone should talk to CFNetwork experts about this at some point."