A system administrator is troubleshooting DNS resolution issues on a Linux workstation. Standard hostname lookups for small A records succeed without issue. However, when requesting DNSSEC-signed responses from an internal DNS server, queries fail. The administrator runs the following command to diagnose the problem:
$ dig +dnssec @192.168.10.5 security-test.lab.internal
;; Truncated, retrying in TCP mode.
;; connection timed out; no servers could be reached
Which TWO of the following statements accurately identify the root cause of this failure and the appropriate corrective action?
- An intermediate firewall rule is permitting UDP port 53 traffic but blocking TCP port 53 traffic.Answer
- The administrator must update security group/firewall rules to allow outbound TCP port 53 traffic to the DNS server.Answer
- CThe DNS server is missing an authoritative AAAA record for the queried host, preventing EDNS0 buffer negotiation.
- DThe client resolver must execute a 3-way TCP handshake before any UDP port 53 payload exchange can occur for DNSSEC validation.
Answer
The failure is caused by an intermediate firewall blocking TCP port 53 traffic, which is required when DNSSEC responses set the Truncation (TC) bit. The issue is resolved by updating firewall rules to permit TCP port 53 traffic between the host and DNS server.
DNS queries operate primarily over UDP port 53. However, when responses (such as DNSSEC keys and signatures) exceed MTU or EDNS0 payload buffer limits, the server returns a response with the Truncation (TC) bit set. The resolver then retries over TCP port 53. If an intermediate firewall permits UDP port 53 but blocks TCP port 53, the client experiences a connection timeout during the retry. Permitting TCP port 53 on network firewalls resolves this truncation fallback failure.
Step-by-Step Solution
Key Concept
DNS Truncation (TC Bit) and TCP Port 53 Fallback
Estimated Time:2m 30s