Examkin

Question

Difficulty: HardTroubleshooting DNS and Name Resolution Services

A network engineer is troubleshooting name resolution failures for a corporate portal on a Linux workstation. The engineer executes an initial query using `dig @10.50.1.10 portal.corp.local` and receives the following output snippet:

text
;; flags: qr rd ra tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; MSG SIZE rcvd: 52

To troubleshoot further, the engineer attempts an explicit TCP query using `dig +tcp @10.50.1.10 portal.corp.local`, which results in a connection timeout after 15 seconds. Standard UDP ICMP reachability to `10.50.1.10` is verified. Which of the following is the root cause of this name resolution failure?

  1. An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.Answer
  2. B
    The DNS server lacks a valid A or AAAA record for portal.corp.local, causing the resolver to fail back to TCP to request missing resource records.
  3. C
    The local workstation resolver incorrectly interprets the truncated flag as an authoritative SERVFAIL response and misroutes the TCP query.
  4. D
    The DNS server protocol implementation requires TCP for initial domain queries and uses UDP only as a secondary fallback protocol.

Answer

An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.
The output from `dig` explicitly shows the `tc` (truncation) header flag. According to DNS standard specifications (RFC 1035), when a server response exceeds the maximum allowed payload size for a UDP datagram, the server sets the `tc` bit. Upon detecting this bit, the client's resolver is designed to re-issue the query using TCP on port 53 to receive the full data stream. Because the explicit `dig +tcp` query timed out while UDP/ICMP reachability was confirmed, an intermediate firewall or security control is blocking TCP port 53, preventing the resolution process from completing.

Step-by-Step Solution

1
Analyze the initial DNS query output flags.
The `dig` output contains the `tc` (truncated) flag, indicating the server's response was larger than the maximum allowed UDP packet size and was cut off.
When a DNS response payload exceeds the UDP limit, the server sets `tc` to instruct the client to re-query using TCP.
2
Analyze the explicit TCP query result (`dig +tcp`).
The command timed out after 15 seconds.
A timeout specifically on TCP port 53 (while ICMP/UDP reachability exists) points to intermediate filtering (Access Control List or firewall) blocking TCP traffic on port 53.
3
Synthesize findings to determine root cause.
Because UDP responses are truncated and TCP port 53 is blocked, the client cannot successfully retrieve the complete DNS resource records.
DNS relies on TCP port 53 for fallback when responses exceed UDP size limits. Blocking TCP port 53 breaks large DNS responses.

Key Concept

DNS Protocol Operations & TCP Fallback Truncation Mechanics
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic