Examkin

Question

Difficulty: MediumDNS Infrastructure and Record Types

A systems administrator is investigating DNS resolution issues where internal clients receive truncated response errors when requesting resource-heavy records from a local name server. Running `dig` on a diagnostic host returns the following command output:

;; Truncated, retrying in TCP mode.
;; Connection to 10.20.4.15#53(10.20.4.15) failed: connection refused.

Based on this diagnostic output, what is the primary cause of the DNS resolution failure, and how should it be resolved?

  1. TCP port 53 is blocked by a network firewall or service policy, which prevents DNS from falling back to TCP when response payloads exceed the 512-byte UDP limit.Answer
  2. B
    DNS operates exclusively over UDP, so the client resolver must be reconfigured to disable TCP transport protocols for all name resolution traffic.
  3. C
    The local DNS server is operating on UDP port 5353, causing a standard port and service protocol mismatch for recursive queries.
  4. D
    The TXT records on the authoritative server must be converted into CNAME records to force smaller response packet sizes.

Answer

TCP port 53 is blocked by a network firewall or service policy, which prevents DNS from falling back to TCP when response payloads exceed the 512-byte UDP limit.
While DNS queries default to UDP port 53 for efficiency, any response that exceeds the standard UDP payload size of 512 bytes triggers the Truncation (TC) flag. Upon receiving a truncated response, compliant DNS stub resolvers automatically fail over to TCP port 53 to retrieve the complete data set. A 'connection refused' error during the TCP fallback indicates that TCP port 53 is blocked by a network security device or disabled on the DNS daemon.

Step-by-Step Solution

1
Analyze the command output
The client attempted a standard UDP DNS query but received a truncated payload flag, prompting an automatic retry using TCP mode on port 53.
When a DNS response exceeds 512 bytes (without EDNS0 buffer extensions or when EDNS0 buffer is exceeded), the server sets the TC (truncation) flag.
2
Identify the connection failure
The attempt to establish a TCP connection to `10.20.4.15:53` resulted in `connection refused`.
This indicates that TCP port 53 is either blocked by a firewall ACL or the DNS daemon is not listening on TCP port 53.
3
Determine the corrective action
Ensure TCP port 53 is allowed through firewalls and listening on the server.
Allowing TCP port 53 enables DNS clients to successfully retrieve truncated responses larger than 512 bytes.

Key Concept

DNS Transport Protocols (UDP vs. TCP Port 53) and Truncation
Rate this question

Topics

DNS Infrastructure and Record Types

More questions from this topic