AuthManager is calling BlockManager::isDnsBlacklisted directly, independently of checking the user's block. This leads to some odd effects:
(1) An unblocked user with the 'ipblock-exempt' right can still be blocked from creating an account from an affected IP, even though they will be unaffected by the block otherwise.
(2) As @dom_walden points out, DNS blacklisted IPs get special treatment, whereas proxy list IPs don't.

It looks like the DNS blacklist check for account creation was added some time ago (52f18d86dc41), before individual blocks could prevent account creation. It's difficult to find any obvious evidence that (1) and (2) are intentional.

We could clean this up - and make it easier to infer intent - by doing the following:

• Have AuthManager::checkAccountCreatePermissions check for a block just once (after T206163, the strictest features of all the blocks found will be applied).
• Have the SystemBlock for an IP in the DNS blacklist explicitly disallow account creation.
• Have the SystemBlock for an IP in the proxy list explicitly disallow account creation.

This would mean (1) and (2) are not the case any more. We could instead clean this up in a way that preserves (1) and (2), if anyone knows of a reason why we should do that.