DNS and TCP

[Bill Manning]

% I would like to provide them an example of where their blocking DNS
% services using TCP may cause problems.  Specific possibilities that I
% can imagine would include:
% 
% 	Large numbers of glue records (lots of NS records for the zone)
% 	Large numbers of answers (multiple records, maybe MX records?)
% 	Large answers (a large TXT record)
% 
% Bill Larson (wllarso at swcp.com)

	signed zones.  
	some SRV & NAPTR replies.
	things with CERTs.

	More interestingly, folks w/ EDNS0 capable systems will
	generate replies that trigger UDP fragmentation.  The
	claim is that things like PIX will drop fragemented UDP
	datagrams.  Is this true?  Will other firewall/IDS systems
	do the same?


--bill