cmd/cli: ensure set/reset DNS is done before checking OS resolver

Otherwise, new DNS settings could be reverted by dns watchers, causing
the checking will be always false.

cmd/cli/prog.go

@@ -728,7 +728,7 @@ func (p *prog) dnsWatchdog(iface *net.Interface, nameservers []string, allIfaces
 			mainLog.Load().Debug().Msg("stop dns watchdog")
 			return
 		case <-ticker.C:
-			if p.leakingQuery.Load() {
+			if p.leakingQuery.Load() || p.um.isChecking(upstreamOS) {
 				return
 			}
 			if dnsChanged(iface, ns) {