Examkin

Question

Difficulty: HardDNS Infrastructure and Record Types

A network systems administrator is troubleshooting name resolution issues after enabling DNSSEC on an enterprise authoritative DNS server. Internal client stub resolvers successfully resolve standard small AA record queries, but fail with SERVFAILSERVFAIL errors when querying domain names that return large responses containing multiple RRSIGRRSIG and DNSKEYDNSKEY records. A diagnostic check with `dig +dnssec +ignore` succeeds over UDP, but standard `dig +dnssec` fails when payload size exceeds the 512-byte limit and truncation occurs.

An audit of the network firewall logs reveals the following blocked log entries:

`DROP OUTBOUND SRC=192.168.10.25 DST=198.51.100.53 PROTO=TCP SPT=49152 DPT=53`

Which of the following actions should the administrator take to permanently resolve this name resolution failure?

  1. Configure the network firewall to permit outbound traffic from the internal DNS server to external authoritative servers on TCP port 53.Answer
  2. B
    Reconfigure the internal DNS resolvers to forward all DNSSEC validation requests to port 853 using DNS over TLS (DoT).
  3. C
    Modify the zone file records to replace all DNSKEY records with standard CNAME aliases to reduce packet payload size below 512 bytes.
  4. D
    Disable EDNS0 on the DNS server so that all truncated packets are automatically converted into UDP broadcast frames.

Answer

The administrator must update firewall rules to allow outbound TCP port 53 traffic from the internal DNS server to remote DNS servers.
DNS uses UDP port 53 for normal queries under 512 bytes. However, when responses (such as those carrying DNSSEC records like RRSIGRRSIG and DNSKEYDNSKEY) exceed the maximum buffer size, the DNS server sets the TC (Truncation) bit. The client or recursive resolver must immediately retry the query over TCP port 53. Because the firewall was dropping outbound TCP port 53 packets, truncated DNSSEC queries timed out and caused SERVFAILSERVFAIL errors.

Step-by-Step Solution

1
Analyze the diagnostic command behavior and firewall log output.
Standard UDP DNS traffic succeeds, but truncated DNSSEC responses requiring fallback fail because TCP port 53 outbound packets are dropped by the firewall.
DNS relies primarily on UDP port 53 for standard queries under 512 bytes (or up to EDNS0 buffer limits), but automatically requires TCP port 53 when the response payload has the Truncation (TC) bit set.
2
Evaluate protocol requirements for DNSSEC payload delivery.
DNSSEC responses containing cryptographic signatures (RRSIGRRSIG) frequently exceed 512 bytes and require TCP fallback to transmit complete data streams reliably.
Without TCP port 53 permitted through stateful firewalls, any truncated DNS query fails, producing SERVFAILSERVFAIL on validating resolvers.
3
Select the appropriate resolution step.
Allowing TCP port 53 outbound on the network firewall enables resolvers to establish TCP sessions for truncated DNSSEC queries.
This maintains complete compliance with RFC 5966 and restores normal DNSSEC resolution functionality.

Key Concept

DNS Transport Layer Mechanics (UDP vs TCP Port 53)
Estimated Time:2m 0s
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic