They check the license key hasn’t been revoked via a DNS lookup, but not at install time, so often the user installs, uses, then miraculously finds it disabled a few weeks later; then runs to find a new copy/keygen and the whole situation starts again.

(e: they also route the DNS lookup via bonjour if it’s running, so you have to keep bonjour segregated from the internet too, which can cause other problems)

Sadly, they do license key checking via a DNS lookup, and not all application-level firewalls block DNS.