Examkin

Question

Difficulty: MediumTroubleshooting DNS and Name Resolution Services

A network administrator is troubleshooting an issue where client workstations can resolve standard hostnames, but queries returning large DNS Security Extensions (DNSSEC) records fail to resolve. To isolate the issue, the administrator runs the following command from an affected host:

$ dig +tcp @10.0.0.53 sec.enterprise.local +dnssec
;; Communications error to 10.0.0.53#53(10.0.0.53): connection timed out

Standard `dig` queries executed without the `+tcp` flag complete successfully over UDP. Which of the following is the most likely root cause of this resolution failure?

  1. An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.Answer
  2. B
    DNS inherently operates only over UDP port 53, making the explicit `+tcp` query flag an invalid protocol request.
  3. C
    The technician misinterpreted the output, confusing a non-authoritative cache miss response with an unreachable server timeout.
  4. D
    TCP-based DNS queries must be redirected to port 5353 because standard DNS servers do not listen for TCP on port 53.

Answer

An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.
DNS relies on UDP port 53 for standard queries, but falls back to TCP port 53 whenever response data exceeds the maximum UDP packet size (common with DNSSEC records) or when requested explicitly via tools like `dig +tcp`. Because UDP queries succeed but TCP queries time out, a network firewall or access control list (ACL) is dropping TCP port 53 traffic.

Step-by-Step Solution

1
Analyze the baseline behavior vs the failure condition.
Standard UDP DNS queries to 10.0.0.53 succeed, but forced TCP DNS queries time out.
Isolates the problem specifically to the transport protocol (TCP vs UDP) rather than general IP unreachability or invalid DNS record data.
2
Evaluate protocol requirements for DNS operations.
DNS uses UDP port 53 for standard small lookups, but relies on TCP port 53 when responses exceed payload limits (like DNSSEC) or for explicit TCP queries.
Explains why basic queries work while DNSSEC queries requiring TCP fail.
3
Correlate CLI output timeout with network access controls.
A 'connection timed out' error on port 53 over TCP indicates packet dropping by a firewall or access control list (ACL).
Pinpoints the root cause as blocked TCP port 53 traffic on an intervening network security device.

Key Concept

DNS Transport Layer Protocols (UDP/TCP Port 53)
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic