Examkin

Question

Difficulty: MediumDNS Infrastructure and Record Types

A network administrator is troubleshooting an issue where internal workstation clients can resolve standard internal hostnames, but fail when attempting to query external DNSSEC-signed domains that return large response payloads exceeding 512 bytes. Packet captures reveal that the external DNS server sends a response with the TrunCation (TC) flag set over UDP port 5353, after which the client's automated follow-up attempt fails completely. Which firewall configuration issue is most likely causing this name resolution failure?

  1. Outbound and inbound TCP traffic on port 53 is blocked by the firewall.Answer
  2. B
    Outbound and inbound UDP traffic on port 53 is blocked by the firewall.
  3. C
    UDP port 5353 traffic is blocked, preventing Multicast DNS (mDNS) fallback resolution.
  4. D
    The external domain host is missing an AAAA record required for large packet handling.

Answer

The firewall is blocking outbound and inbound TCP traffic on port 53, preventing the client from falling back to TCP after receiving a truncated UDP DNS response.
Standard DNS operations use UDP port 53 for fast, stateless queries. However, when a DNS answer exceeds the standard byte limit (512 bytes without EDNS0 extensions, common with DNSSEC records), the server sets the TC (TrunCation) flag bit in the DNS response header. This instructs the client stub resolver to establish a TCP connection over port 53 to re-issue the query and receive the full answer. If a security firewall allows UDP port 53 but blocks TCP port 53, the client receives the truncated UDP response but fails to complete the subsequent TCP lookup.

Step-by-Step Solution

1
Analyze the observed behavior in the packet capture.
The DNS server sets the TC (TrunCation) header bit in the UDP port 53 response.
The response payload (such as DNSSEC keys/signatures) exceeds the single UDP packet payload threshold.
2
Determine the standard DNS protocol behavior upon receiving a truncated response.
The client resolver must switch from UDP port 53 to TCP port 53 to establish a reliable stream for the complete DNS answer.
TCP supports payload segmentation and reliable delivery without arbitrary size limits inherent to basic UDP DNS frames.
3
Identify why the follow-up request fails.
The firewall blocks TCP port 53 traffic, interrupting the TCP three-way handshake required to complete the query.
DNS relies on both UDP port 53 for standard queries and TCP port 53 for truncated responses and zone transfers.

Key Concept

DNS Protocol Selection (UDP vs TCP Port 53) and Truncation (TC Bit)
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic