Courseiva
Footprinting, Reconnaissance and ScanningmediumMultiple ChoiceObjective-mapped

CEH Footprinting, Reconnaissance and Scanning Practice Question

A security analyst issues the command `dnsenum example.com` and receives a list of subdomains, mail servers, and name servers. What information is revealed by the presence of multiple MX records?

⚠ Common exam trap

Many exam-takers confuse multiple MX records with multiple A records for a single hostname, or incorrectly assume that any multiplicity in DNS records indicates a security issue, rather than recognizing it as a standard high-availability design.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The domain uses multiple mail servers for load balancing and failover

Multiple MX records in a DNS zone file indicate that the domain is configured with more than one mail exchange server. This setup provides redundancy and load balancing for email delivery, as defined in RFC 5321. The `dnsenum` tool enumerates these records from the DNS server, revealing the domain's email infrastructure design.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The domain has been compromised

    Why it's wrong here

    Multiple Mail Exchanger (MX) records are a standard and expected configuration for many domains, indicating a robust email infrastructure rather than a compromise. These records specify the mail servers responsible for accepting email for a domain, and having several allows for redundancy and efficient mail handling. The presence of multiple MX records alone does not provide any direct evidence or indication that a domain has been compromised.

  • The domain uses a single mail server with multiple aliases

    Why it's wrong here

    This statement is incorrect because MX records point to the canonical hostname of a mail server, not directly to aliases. While a single mail server might have multiple aliases, these aliases are typically configured using CNAME (Canonical Name) records, which map an alias name to a canonical domain name. MX records specifically define the mail servers responsible for receiving email for a domain, and multiple MX records usually indicate distinct mail servers, not just aliases for one.

  • The domain uses multiple mail servers for load balancing and failover

    Why this is correct

    The presence of multiple Mail Exchanger (MX) records for a domain is a strong indicator of a resilient email infrastructure designed for both load balancing and failover. When multiple MX records exist, mail sending agents attempt delivery to the server with the lowest preference value first. If that server is unavailable or overloaded, they proceed to the next highest preference, ensuring email delivery continuity and distributing the incoming mail traffic across several servers. This configuration significantly enhances reliability and availability.

  • The domain is participating in a DDoS attack

    Why it's wrong here

    The dnsenum command primarily gathers publicly available DNS information, such as MX records, which describe a domain's mail infrastructure. This type of information gathering provides no direct or indirect indication that a domain is actively participating in a Distributed Denial of Service (DDoS) attack. DDoS attacks involve overwhelming a target with traffic, and their detection typically relies on monitoring network traffic patterns, server load, and unusual connection volumes, none of which are revealed by standard DNS enumeration.

Visual reference

Client Recursive Resolver Root DNS (13 root servers) TLD DNS (.com, .org, …) Authoritative example.com query IP addr answer

About these practice questions

One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.