From 30ccde7cdc930be67ccf6d0ec69a736ebab6bd92 Mon Sep 17 00:00:00 2001
From: Brian Conry <bconry@isc.org>
Date: Wed, 30 Oct 2019 14:16:04 -0500
Subject: [PATCH] arm: Add an explanation on the effect of
 'require-server-cookie yes;'

(cherry picked from commit c6f91f8bd0edb9be84995cda9392ee475c5cd925)
---
 doc/arm/Bv9ARM-book.xml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 7b5e0ddf15..13c26355c3 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -6046,7 +6046,11 @@ options {
 		  Set this to <userinput>yes</userinput> to test that DNS
 		  COOKIE clients correctly handle BADCOOKIE or if you are
 		  getting a lot of forged DNS requests with DNS COOKIES
-		  present.
+		  present. Setting this to <userinput>yes</userinput> will
+		  result in reduced amplification effect in a reflection
+		  attack, as the BADCOOKIE response will be smaller than
+		  a full response, while also requiring a legitimate client
+		  to follow up with a second query with the new, valid, cookie.
 		</para>
 	      </listitem>
 	    </varlistentry>