arm: Add an explanation on the effect of 'require-server-cookie yes;'

(cherry picked from commit c6f91f8bd0edb9be84995cda9392ee475c5cd925)

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index d5af99f378d8b56f66fa8ec21ff505108e83c972..74cfaf30347e700ed4ae5a52a798b3df93523a33 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -6187,7 +6187,11 @@ options {
                  Set this to <userinput>yes</userinput> to test that DNS
                  COOKIE clients correctly handle BADCOOKIE or if you are
                  getting a lot of forged DNS requests with DNS COOKIES
-                 present.
+                 present. Setting this to <userinput>yes</userinput> will
+                 result in reduced amplification effect in a reflection
+                 attack, as the BADCOOKIE response will be smaller than
+                 a full response, while also requiring a legitimate client
+                 to follow up with a second query with the new, valid, cookie.
                </para>
              </listitem>
            </varlistentry>