Good you are not blocking packets > 512.


This one didn't reach the fragmentation threshold (1203 < 1500).
SE have tuned their dnskey response in the last two years.
I get 1906 bytes which is well over the threshold.

;; Query time: 229 msec
;; SERVER: 2001:500:3::42#53(2001:500:3::42)
;; WHEN: Tue Feb 9 08:20:00 2010
;; MSG SIZE rcvd: 1906


Run "dig +trace +dnssec 11.94.88.195.dnsbl.sorbs.net" from the box the
recursive nameserver is on and see what happens.


Run "dig +trace +dnssec euro-index.be" and see what happens.


Run "dig +trace +dnssec euro-index.be mx" and see what happens.

Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia

Click Here	Cedric Lejeune 2010-02-08 14:25:09
Click Here	Florian Weimer 2010-02-08 15:21:17
Currently Viewing : This Article	Mark Andrews		2010-02-08 21:26:19
Click Here	Cedric Lejeune 2010-02-09 16:54:30
Click Here	Mark Andrews 2010-02-10 00:28:47
Click Here	Cedric Lejeune 2010-02-10 09:45:34
Click Here	Dave Sparro 2010-02-10 15:16:18
Click Here	Kevin Oberman 2010-02-10 16:09:59

---