Examkin

Question

Difficulty: MediumTroubleshooting DNS and Name Resolution Services

A network technician is troubleshooting an issue where workstations in a remote branch office cannot resolve hostnames within the internal domain `internal.corp.com`, although external internet domains resolve normally. The technician runs diagnostic commands from a affected workstation with the following results:

> nslookup internal.corp.com
Server: 192.168.1.1
Address: 192.168.1.1#53

** server can't find internal.corp.com: SERVFAIL

> dig @10.10.20.5 internal.corp.com
;; QUESTION SECTION:
;internal.corp.com. IN A

;; ANSWER SECTION:
internal.corp.com. 3600 IN A 10.10.20.50

Based on the output, which TWO of the following are the most likely root causes of this name resolution failure? (Select TWO.)

  1. The local router/resolver at 192.168.1.1 lacks a conditional forwarding rule configured for the `internal.corp.com` domain zone.Answer
  2. Firewall rules or access control lists (ACLs) are filtering DNS traffic between the local resolver (192.168.1.1) and the authoritative DNS server (10.10.20.5).Answer
  3. C
    The `nslookup` command failed because it reads entries exclusively from the client's local HOSTS file rather than sending queries over the network.
  4. D
    Standard DNS resolution queries operate exclusively over TCP port 53, so any network path allowing only UDP port 53 will fail.

Answer

The most likely root causes are that the local DNS resolver at 192.168.1.1 lacks a conditional forwarder for the internal domain, and network firewall or ACL policies are blocking DNS traffic (port 53) between the local resolver and the internal authoritative DNS server.
Directly querying the internal DNS server at 10.10.20.5 successfully returns the IP address, proving the DNS record exists and is valid. The failure only occurs when client workstations query their default local gateway/resolver (192.168.1.1), returning a SERVFAIL error. This occurs when the local resolver either does not have a conditional forwarder configured to send requests for `internal.corp.com` to 10.10.20.5, or when firewalls/ACLs block port 53 communication between 192.168.1.1 and 10.10.20.5.

Step-by-Step Solution

1
Analyze the `nslookup` command output
The workstation queries its local DNS server (192.168.1.1), which returns a `SERVFAIL` status message for `internal.corp.com`.
SERVFAIL indicates the local resolver encountered an error attempting to process the query recursively or forward it.
2
Analyze the `dig` command output
Directly targeting the authoritative internal DNS server (`dig @10.10.20.5`) returns a valid A record (`10.10.20.50`).
This confirms that the record exists on the authoritative server and the server itself is functioning correctly.
3
Identify the break in the resolution path
The failure occurs specifically when 192.168.1.1 is tasked with resolving the query.
This points to either a misconfiguration on 192.168.1.1 (missing conditional forwarder) or network path blocking between 192.168.1.1 and 10.10.20.5.

Key Concept

Troubleshooting Split-Horizon DNS and Resolver Forwarding
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic