Impact is not documented clearly. As per my experience, evaluation of export policy rules will be stopped at the rule index which has unresolvable host name. In addition, by known bug fixed in 8.3.1, evaluation will be failed even if rule index of unresolvable host name is greater than the rule which matches currently accessing client.
Using host name, policy rule tends to become bigger. Evaluation by large policy brings latency and CPU load. Use of IP address and mask is better unless you need to manage rules by host name anyway.
>>by known bug fixed in 8.3.1, evaluation will be failed even if rule index of unresolvable host name is greater than the rule which matches currently accessing client.
Sorry, I don't quite understand this part.
Let's say I have an unresolvable host name A, and it's rule index is 100. At moment when I found the matching for the other client B at rule index 30. Will I still have a problem? which means as long as I have an unresolvable host name existing in the export policy, I will have the problem?
Policy rule evaluation is aborted when the processing rule has unresolvable host name. If client access matches any rule before that point and cDOT does not affected by bug ID 891293,cDOT does not attempt further evaluation and client access will be accepted as it is. But in version of cDOT affected by bug ID 891293, cDOT does not stop policy evaluation operation at the point of matched rule.
Above page only mention to delay. But unresolvable host name brings access failure in conjunction with this bug. Later rule will be also processed, and if any later rule has unresolvable host name, evaluation process is aborted and the result of previous rules is discarded. Client access fails by such reason.