CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, a tester runs 'dnsrecon -d example.com -t axfr' and receives a full list of DNS records. What does this indicate about the target's DNS configuration?
⚠ Common exam trap
Watch out — candidates often confuse 'authoritative' with 'vulnerable' — being authoritative is normal, but allowing unrestricted zone transfers is the misconfiguration; EC-Council often tests this by making option D sound correct because the server is authoritative, but the real issue is the lack of access control on the AXFR query.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DNS server allows zone transfers from any host
The 'dnsrecon -d example.com -t axfr' command performs a DNS zone transfer (AXFR) request. Receiving a full list of DNS records indicates that the target DNS server is misconfigured to allow zone transfers from any host, which exposes the entire DNS zone data (including internal hostnames and IP addresses) to unauthorized parties. This is a critical information disclosure vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server has DNSSEC enabled
Why it's wrong here
DNSSEC (Domain Name System Security Extensions) is designed to provide data origin authentication and integrity validation for DNS responses, preventing spoofing and cache poisoning. While crucial for overall DNS security, DNSSEC does not inherently prevent or restrict zone transfers. A server can have DNSSEC enabled for its zones and still allow unauthorized zone transfers, as these are separate security mechanisms addressing different types of threats.
- ✗
The DNS server allows recursive queries
Why it's wrong here
Recursive queries involve a DNS server fully resolving a query on behalf of a client, potentially contacting multiple other DNS servers until it finds the answer. This is distinct from a zone transfer (AXFR/IXFR), which is a bulk data transfer of an entire zone file from a primary to a secondary DNS server. Allowing recursive queries, while sometimes a security concern (e.g., amplification attacks), does not directly indicate or enable unauthorized zone transfers.
- ✓
The DNS server allows zone transfers from any host
Why this is correct
The `dnsrecon` tool, when used with the `-d` flag, attempts to perform a zone transfer (AXFR) from the specified domain's DNS servers. A successful execution, as implied by the question context, indicates that the DNS server is configured to permit full zone transfers to any requesting host, including unauthorized external entities. This represents a significant security misconfiguration, as it exposes sensitive network topology and host information.
- ✗
The DNS server is authoritative for the domain
Why it's wrong here
An authoritative DNS server is indeed responsible for providing definitive answers for a specific domain, holding the complete zone file. However, being authoritative does not automatically imply that it allows zone transfers to any requesting client. Best practice dictates that authoritative servers should restrict zone transfers (AXFR/IXFR) only to designated secondary DNS servers, preventing public disclosure of internal network details. A successful `dnsrecon` zone transfer signifies a misconfiguration, not merely its authoritative status.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a reconnaissance phase, a tester uses `dnsrecon -d example.com -t axfr`. What specific DNS query is being attempted?
medium- A.A subdomain brute-force
- ✓ B.A zone transfer request
- C.A reverse DNS lookup
- D.A SRV record enumeration
Why B: The `-t axfr` flag in `dnsrecon` specifies a zone transfer request (AXFR). This query attempts to retrieve the entire DNS zone file from a nameserver, which can reveal all DNS records for the domain. A successful zone transfer is a critical misconfiguration because it exposes internal network topology and hostnames.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.