Examkin

Question

Difficulty: MediumTroubleshooting DNS and Name Resolution Services

A network administrator is troubleshooting a DNS lookup issue on a Linux client. Standard hostname resolution over UDP functions normally for small queries, but operations requiring larger payloads fail. When testing the DNS server at IP address `172.16.10.5` using the TCP mode (`+vc` flag), the administrator observes the following output:

text
$ dig @172.16.10.5 app.corp.internal +vc
;; Connection to 172.16.10.5#53(172.16.10.5) for app.corp.internal failed: connection refused.

Which of the following is the most likely root cause of this failure?

  1. An intermediate network firewall or ACL is blocking traffic on TCP port 53.Answer
  2. B
    DNS operates strictly over UDP port 53, so forcing TCP connection attempts will always fail.
  3. C
    The local system DNS resolver output indicates an invalid static entry in the client's HOSTS file.
  4. D
    The specified target domain is missing an IPv6 AAAA record on the authoritative DNS server.

Answer

An intermediate network firewall or ACL is blocking traffic on TCP port 53.
DNS relies on UDP port 53 for lightweight queries, but switches to TCP port 53 when responses exceed payload limits or when explicitly configured via tools like `dig +vc`. A 'connection refused' response when attempting to communicate over TCP indicates that network transport on TCP port 53 is being blocked by a security ACL or firewall filter.

Step-by-Step Solution

1
Analyze the utility command and flags used
The `dig` command specified `@172.16.10.5` with the `+vc` flag, forcing the request to establish a TCP connection on port 53 rather than standard UDP datagrams.
Understanding tool behavior identifies whether the failure occurs at the application service level or transport transport layer.
2
Evaluate the specific error message
The output returns 'connection refused' for port 53 under TCP mode.
This error indicates that TCP connection establishment (SYN/ACK) failed because traffic to TCP port 53 is explicitly denied or blocked by a firewall filter between the client and DNS server.
3
Correlate with DNS protocol operations
DNS uses UDP port 53 for standard queries under 512 bytes (or EDNS0 limits) and switches to TCP port 53 for truncated payloads or explicit TCP requests.
Blocking TCP port 53 prevents large DNS responses, zone transfers, and forced TCP fallbacks from succeeding.

Key Concept

DNS Protocol Transport Mechanism (TCP vs UDP Port 53)
Estimated Time:1m 30s
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic