<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br><div>I haven’t seen a final draft yet, so hopefully it’s not too late to suggest further additions :)</div><div><br></div><div>A talk [1] at DNS OARC 42 this morning reminded me of a common pitfall we might do well to point out in the document.</div><div><br></div><div><br></div><div>Beware of state in the network!</div><div><br></div><div>State holding middleware, e.g. firewalls, load-balancers, whether in discrete devices, or local to the nameserver host itself, e.g. connection tracking in Linux netfilter, often come with a default configuration not tuned in expectation of the high volumes of UDP seen at a DNS server. A typical failure scenario sees state tables are overrun, resulting in dropped packets.</div><div><br></div><div>Careful consideration should be made in regard to tuning how state is held in the network, is it needed at all?</div><div><br></div><div><br></div><div>dave</div><div><br></div><div><br></div><div>[1]</div><div><br></div><div>Real world challenges with large responses, truncation, and TCP</div><div><br></div><div><<a href="https://indico.dns-oarc.net/event/48/contributions/1036/">https://indico.dns-oarc.net/event/48/contributions/1036/</a>></div></body></html>