CEH Footprinting and Reconnaissance Practice Question

Exhibit

Refer to the exhibit.

```
C:\Users\tester> nslookup -type=MX exampledomain.com
Server:  dns.example.com
Address:  192.168.1.1

exampledomain.com
        MX preference = 10, mail exchanger = mail1.exampledomain.com
        MX preference = 20, mail exchanger = mail2.exampledomain.com
```

An ethical hacker runs the command shown in the exhibit. Which of the following conclusions can be drawn from the output?

⚠ Common exam trap

Watch out — candidates often assume multiple MX records imply automatic forwarding or failover, but in reality, the secondary server only receives mail if the primary is unreachable, and forwarding is a separate server-side configuration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The domain has two mail exchange servers

The output shows two MX records for the domain, each with a preference value (10 and 20). MX records specify mail exchange servers, and the presence of two distinct entries indicates the domain has two mail exchange servers. The lower preference value (10) is the primary server, and the higher value (20) is a secondary or backup server.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The domain has two mail exchange servers
Why this is correct
When a DNS lookup tool, such as `nslookup`, is used to query for Mail Exchange (MX) records, the response lists the servers designated to receive email for that domain. The presence of two distinct MX records in the output explicitly indicates that the domain has two separate mail exchange servers configured. Each record points to a specific host responsible for handling incoming mail, often with a preference value to guide delivery order.
✗
The DNS server is configured to block zone transfers
Why it's wrong here
A zone transfer (AXFR or IXFR) is a specific type of DNS query used to replicate an entire DNS zone file, typically between authorized DNS servers. The command in question, which queries for MX records, is a standard lookup for a specific resource record type, not an attempt to initiate a zone transfer. Therefore, the results of an MX record query provide no information about whether the DNS server is configured to block or allow zone transfers.
✗
Mail is automatically forwarded to a backup server
Why it's wrong here
MX records specify the mail servers responsible for a domain and include a preference value (a numerical priority, where lower numbers indicate higher preference) to guide sending mail servers on which server to try first. While multiple MX records provide redundancy and a fallback mechanism, they do not inherently indicate automatic mail forwarding to a 'backup' server. Instead, they instruct external sending servers to attempt delivery to the highest preference server first, then fall back to lower preference servers if the primary is unavailable, rather than an internal forwarding configuration.
✗
The domain has an SPF record configured
Why it's wrong here
An SPF (Sender Policy Framework) record is a type of DNS TXT record that specifies which mail servers are authorized to send email on behalf of a domain, primarily used to combat email spoofing. The command shown specifically queries for MX (Mail Exchange) records, which are distinct from TXT records. Without explicitly querying for TXT records, the output will not reveal the presence or absence of an SPF record for the domain, as it's a different record type.

Go deeper

CEH Footprinting and Reconnaissance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question