Very interesting and informative posting. I find the DNSSEC issuse regarding 'EDNS0', and the problem with a system being used/drained by the max. UDP payload size advertizing & amplyfying especially interesting. It will be interesting to see the next move from 'the inventor'! I'll have to look a bit deeper into DNSSEC, a bit in closest future. I must re-read 4033 & 4641 ASAP. Think there might be another way to 'pile on' even more,. Must toy more with the UDP Payload technique even morefirst though! . Musttest , test...! And thank's, great work Mike & Andrea! Thank's for sharing!