need-to-fragment is the only one that matters, really.
AFAIK "RELATED" matches it. Like I said, I'm going to setup a test
topology to verify it with my own eyes. I haven't yet done it yet. Maybe
next week.
DNS can get quite upset if port unreach replies are not allowed back in some
cases