DNS Lookups on consul.service.consul when ACL set to deny?

Also, when I go to the UI and use the anonymous token, then go to the Service page and click on “consul”, I’m getting:

404 (Not found)

“Consul returned an error. You may have visited a URL that is loading an unknown resource, so you can try going back to the root or try re-submitting your ACL Token/SecretID by going back to ACLs.
Try looking in our documentation

So something-something ACL is in play here…