The slip parameter affects how rate-limited responses are processed. Say, for example, 8 responses would be rate-limited. By the default slip=2, 4 of those responses (every other one) would be a truncated response and 4 would just not be sent. With slip=0, no responses would be sent at all. with slip=1, 8 truncated responses would be sent. with slip=4, 2 truncated responses would be sent.
Basically, slip allows some responses to get through ("slip through") if they would otherwise be blocked by RRL.
More info from the official BIND9.10 ARM Section 6.2.16.21 "Response Rate Limiting":
Many attacks using DNS involve UDP requests with forged source addresses. Rate limiting prevents
the use of BIND 9 to flood a network with responses to requests with forged source addresses, but could
let a third party block responses to legitimate requests. There is a mechanism that can answer some
legitimate requests from a client whose address is being forged in a flood. Setting
slip
to 2 (its default)
causes every other UDP request to be answered with a small truncated (TC=1) response. The small size
and reduced frequency, and so lack of amplification, of ”slipped” responses make them unattractive
for reflection DoS attacks.
slip
must be between 0 and 10. A value of 0 does not ”slip”: no truncated
responses are sent due to rate limiting, all responses are dropped. A value of 1 causes every response
to slip; values between 2 and 10 cause every n’th response to slip. Some error responses including
REFUSED and SERVFAIL cannot be replaced with truncated responses and are instead leaked at the
slip
rate.
