DNS work and errors
04Evaluation is bounded so a policy cannot cause unlimited DNS-driven work.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.6.4 ↗
RFC 7208 · § 4.6.4EXAMPLE
3 / 3
03
Stop an eleventh term
Exceeding the limit returns permerror instead of recursing forever.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
The total number of DNS-causing terms evaluated is limited to 10.
- The total number of DNS-causing terms evaluated is limited to 10.
- Exceeding the limit produces permerror.
- Temporary DNS failures and permanent policy errors are different results; ip4 and ip6 do not consume this term limit.
Examples are illustrative. Consult the linked RFC and its errata for implementation details.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy