The text on downstream Query validation states that messages which fail IP
version matching or ingress filtering MUST be rejected; however, it doesn't say
how this should be done.