arm: Add an explanation on the effect of 'require-server-cookie yes;'

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index c6f6ec18356e8876913045f3d0b60a98c03650f3..dc7c11e2db803840d7eaca7428488f58cd5c2bab 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -6015,7 +6015,11 @@ options {
                  Set this to <userinput>yes</userinput> to test that DNS
                  COOKIE clients correctly handle BADCOOKIE or if you are
                  getting a lot of forged DNS requests with DNS COOKIES
-                 present.
+                 present. Setting this to <userinput>yes</userinput> will
+                 result in reduced amplification effect in a reflection
+                 attack, as the BADCOOKIE response will be smaller than
+                 a full response, while also requiring a legitimate client
+                 to follow up with a second query with the new, valid, cookie.
                </para>
              </listitem>
            </varlistentry>