On 24/04/2015, at 7:52 am, manning bill wrote:

anything inline that is sensitive to IPv4 UDP packets that are: ) larger than 512 bytes, ) fragmented. do these replies have IPv6 or DNSSEC data in the RRsets?

I would say yes, as all our hosts have both A and AAAA records. Assuming the above, that moves the issue back in my direction. I am seeing requests from a number of the rNS servers and the issue is intermittent so still more trouble shooting needed I think :-) Glen