CEH Footprinting, Reconnaissance and Scanning Practice Question
A security analyst issues the command `dnsenum example.com` and receives a list of subdomains, mail servers, and name servers. What information is revealed by the presence of multiple MX records?
⚠ Common exam trap
Many exam-takers confuse multiple MX records with multiple A records for a single hostname, or incorrectly assume that any multiplicity in DNS records indicates a security issue, rather than recognizing it as a standard high-availability design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The domain uses multiple mail servers for load balancing and failover
Multiple MX records in a DNS zone file indicate that the domain is configured with more than one mail exchange server. This setup provides redundancy and load balancing for email delivery, as defined in RFC 5321. The `dnsenum` tool enumerates these records from the DNS server, revealing the domain's email infrastructure design.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The domain has been compromised
Why it's wrong here
Multiple Mail Exchanger (MX) records are a standard and expected configuration for many domains, indicating a robust email infrastructure rather than a compromise. These records specify the mail servers responsible for accepting email for a domain, and having several allows for redundancy and efficient mail handling. The presence of multiple MX records alone does not provide any direct evidence or indication that a domain has been compromised.
- ✗
The domain uses a single mail server with multiple aliases
Why it's wrong here
This statement is incorrect because MX records point to the canonical hostname of a mail server, not directly to aliases. While a single mail server might have multiple aliases, these aliases are typically configured using CNAME (Canonical Name) records, which map an alias name to a canonical domain name. MX records specifically define the mail servers responsible for receiving email for a domain, and multiple MX records usually indicate distinct mail servers, not just aliases for one.
- ✓
The domain uses multiple mail servers for load balancing and failover
Why this is correct
The presence of multiple Mail Exchanger (MX) records for a domain is a strong indicator of a resilient email infrastructure designed for both load balancing and failover. When multiple MX records exist, mail sending agents attempt delivery to the server with the lowest preference value first. If that server is unavailable or overloaded, they proceed to the next highest preference, ensuring email delivery continuity and distributing the incoming mail traffic across several servers. This configuration significantly enhances reliability and availability.
- ✗
The domain is participating in a DDoS attack
Why it's wrong here
The dnsenum command primarily gathers publicly available DNS information, such as MX records, which describe a domain's mail infrastructure. This type of information gathering provides no direct or indirect indication that a domain is actively participating in a Distributed Denial of Service (DDoS) attack. DDoS attacks involve overwhelming a target with traffic, and their detection typically relies on monitoring network traffic patterns, server load, and unusual connection volumes, none of which are revealed by standard DNS enumeration.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.