Examkin

Question

Difficulty: MediumDNS Lookup and Name Resolution Roles in Enterprise Networks

A network administrator is troubleshooting DNS name resolution in an enterprise network. A client host issues a standard DNS query to an internal recursive DNS server. However, the DNS response payload exceeds 512 bytes because the zone lookup returns a large list of resource records. How does DNS handle transport layer communication when standard UDP responses exceed this size threshold?

  1. The DNS server responds over UDP with the Truncation (TC) flag bit set to 1, signaling the client to re-query the server using TCP port 53.Answer
  2. B
    The DNS client automatically fragments the UDP payload into multiple smaller 512-byte UDP segments at Layer 4 to avoid TCP overhead.
  3. C
    The DNS server automatically elevates the packet priority by switching the destination service port to UDP port 7.
  4. D
    The client encapsulates the DNS lookup in TACACS+ frames on port 49 to handle large administrative queries.

Answer

The DNS server responds over UDP with the Truncation (TC) flag bit set to 1, signaling the client to re-query the server using TCP port 53.
Standard DNS operations utilize UDP port 53 for fast, lightweight name resolution queries. When a DNS response message exceeds the traditional 512-byte limit (without EDNS0 extended mechanisms), the DNS server returns a truncated UDP packet with the Truncation (TC) bit set in the DNS header. Receiving this flag prompts the DNS client host to retry the request using a TCP connection on port 53 to successfully receive the complete response.

Step-by-Step Solution

1
Analyze transport protocols used by DNS
DNS uses UDP port 53 for normal queries/responses due to low overhead, but uses TCP port 53 for zone transfers and responses exceeding traditional size limits.
Traditional DNS over UDP limits message payloads to 512 bytes (unless EDNS0 extensions are negotiated).
2
Determine how DNS signals payload overflow
When a response message is too large for a single 512-byte UDP packet, the DNS server sets the TC (Truncated) bit in the DNS header.
Setting the TC bit informs the resolver client that only partial data was delivered and full data requires a TCP connection.
3
Identify client fallback behavior
Upon receiving the TC bit set in a UDP response, the DNS client opens a connection to TCP port 53 on the DNS server to re-issue the query.
TCP provides connection-oriented reliability and supports larger payload data transfers without truncation.

Key Concept

DNS Transport Layer Mechanics (UDP vs TCP Port 53 and Truncation)
Rate this question

Topics

DNS Lookup and Name Resolution Roles in Enterprise Networks

More questions from this topic