> need-to-fragment is the only one that matters, really. > > AFAIK "RELATED" matches it. Like I said, I'm going to setup a test > topology to verify it with my own eyes. I haven't yet done it yet. Maybe > next week. DNS can get quite upset if port unreach replies are not allowed back in some cases