as far as I know SEP client will try to resolve DNS every time based the time interval as the cache might still hold the details from the past or lets say the user was connected to office till 30 mins ago, now he is sitting in a cafe and using their open WiFi, then the client automatically switch location as out of office or vpn or whatever the setup is. so to put it simple in my understanding SEP client do not use the cache but do a dns look up everything the condition is to be tested.