<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
Rev: 10.2.01oTI4<br>
<br>
I'm having 'intermittent' problems resolving paypal addresses.
Paypal support suggests in <font face="Calibri, Verdana, Helvetica,
Arial"><span style="font-size: 11pt;"></span></font><font
face="Calibri, Verdana, Helvetica, Arial"><font color="#1f497d"><a
href="https://ppmts.custhelp.com/app/answers/detail/a_id/907">https://ppmts.custhelp.com/app/answers/detail/a_id/907</a></font></font><br>
<br>
"If your firewalls are not standards compliant you may experience
intermittent timeouts and slow response times resolving *.paypal.com
domain names. <br>
<br>
The problem is defined as intermittent response to DNS queries for
paypal.com and is centric to the merchant's router/firewall
infrastructure and their ability to handle larger UDP/DNS responses.
<br>
<br>
In these scenarios, the device is dropping the packet, and, because
of UDP, there is no retransmit. Due to the nature of the DNS client,
it tries a second (or more) time and at some point is successful. "<br>
<br>
Our SI is configured to allow TCP and UDP on port dns without size
restriction. Our DNS server is an up-to-date debian installation:
with the DNSSEC RFS'c dating to 1999 and 2005 I can't imagine our
version of bind is incompatible.<br>
<br>
The thing I'm not clear on is whether the SI's allow fragmented
packets by default or not.<br>
<br>
Help appreciated, especially if you've solved the paypal
intermittent timeout issue.<br>
<br>
--- David<br>
</body>
</html>