the pix firewall identifies each outbound dns (domain name service) resolve request, and only allows a single dns response. a host may query several servers for a response (in the case that the first server is slow in responding), but only the first answer to the request is allowed. all additional responses to the request are dropped by the firewall. this feature is always enabled.