Followups probably should go to the dnsops mailing list.
I got tired of things and went back to the original question, and put
together my list of what the "minimum" packets needed for full DNS
performance on the modern Internet.
It is the minimum, based on the security principle deny everything, allow
only what is needed. But "needed" is performance based. So it means not
relying on fallbacks, timeouts or hoping no one complains. It does not
include packets needed for diagnostic or troubleshooting information.
It is based on the "modern" Internet so does not included very deprecated
packets like Source Quench or unimplemented functions like broadcast DNS
queries.
It does include current Internet practices for EDNS, Notify, global DNS
load balancers and error handling I've seen in recent, i.e. less than 10
years old, DNS, Router and OS software.
I didn't included TOS/DSCP and some military options, mainly because I'm
not sure what "modern" military networks are currently using. If you are
using TOS/DSCP or military options, there are some things you will need to
add.
<http://www.donelan.com/dnsacl.html>
<http://www.donelan.com/dnsacl-min-cisco.html>