diff --git a/autonat/README.md b/autonat/README.md
index c003a1060..d57d864b0 100644
--- a/autonat/README.md
+++ b/autonat/README.md
@@ -52,6 +52,22 @@ Upon receiving this message, the peer starts to dial these addresses. It MAY
 dial all of them in parallel. The peer MAY use a different IP and peer ID than
 it uses for its regular libp2p connection to perform these dial backs.
 
+In order to prevent attacks like the one described in [RFC 3489, Section
+12.1.1](https://www.rfc-editor.org/rfc/rfc3489#section-12.1.1) (see excerpt
+below), implementations MUST NOT dial any multiaddress unless it is based on the
+IP address the requesting node is observed as.
+
+> RFC 3489 12.1.1 Attack I: DDOS Against a Target
+>
+> In this case, the attacker provides a large number of clients with the same
+> faked MAPPED-ADDRESS that points to the intended target. This will trick all
+> the STUN clients into thinking that their addresses are equal to that of the
+> target. The clients then hand out that address in order to receive traffic on
+> it (for example, in SIP or H.323 messages). However, all of that traffic
+> becomes focused at the intended target. The attack can provide substantial
+> amplification, especially when used with clients that are using STUN to enable
+> multimedia applications.
+
 If all dials fail, the receiver sends a `DialResponse` message with the
 `ResponseStatus` `E_DIAL_ERROR`. If at least one of the dials complete
 successfully, it sends a `DialResponse` with the `ResponseStatus` `OK`. It