[dns-resolver-tf] DNS Resolver Recommendations

Hello. Under the section discussing Ingress Filtering you failed to discuss the issue of fragment filtering. A very common and powerful DDoS attack is UDP fragment attack: https://ddos-guard.net/en/terms/ddos-attack-types/udp-fragmentation-flood The common thing many ISPs as well as enterprises do to mitigate the attack is to block all fragments which on most servers has almost no effect.  But on DNS and VPN servers, blocking fragments is fatal and therefore a warning needs to be put into the doc that UDP fragments should *never* be blocked to DNS servers - even when under fragment attack.  See: https://puck.nether.net/pipermail/cisco-nsp/2023-December/108992.html for further details. Regards, Hank