Let’s say, for example, you make the mistake of putting a stateful firewall between your users and your recursive DNS servers. As a rough guide, you can expect about 0.1 DNS query per second per user, so about 2000 qps for your site (average, peaks will be higher). Firewalls often rely on a timeout for expiring UDP state, let’s say, 5 minutes or 300 seconds. In this example, the firewall will be keeping 600 000 useless states.