CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, you execute a DNS zone transfer request against a target domain and succeed. Which type of DNS record would you expect to reveal the mail servers for the domain?
⚠ Common exam trap
EC-Council often tests the distinction between record types by making candidates confuse the purpose of an MX record with an A record or CNAME, especially when the question involves identifying services rather than simple hostname resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MX record
An MX (Mail Exchange) record is the DNS record type that specifies the mail servers responsible for accepting email messages on behalf of a domain. During a successful DNS zone transfer, the full zone file is retrieved, and MX records are included, directly revealing the domain's mail server hostnames and priority values.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CNAME record
Why it's wrong here
A CNAME (Canonical Name) record creates an alias, mapping one domain name to another canonical domain name. While CNAMEs are indeed part of a zone file and would be enumerated during a successful DNS zone transfer, their primary function is to simplify management by allowing multiple services or subdomains to point to a single canonical host. They do not inherently reveal critical service infrastructure or direct attack vectors in the same immediate manner as MX records, which explicitly detail email server configurations.
- ✓
MX record
Why this is correct
An MX (Mail Exchanger) record specifies the mail servers responsible for accepting email messages on behalf of a domain, along with their preference values. During a DNS zone transfer, obtaining MX records provides highly valuable intelligence about an organization's email infrastructure, including the hostnames and sometimes internal IP addresses of their mail servers. This information is critical for penetration testers, as it identifies prime targets for email-based attacks, spoofing, or further reconnaissance against mail gateways and associated systems.
- ✗
A record
Why it's wrong here
An A (Address) record maps a domain name or hostname to its corresponding IPv4 address. While A records are fundamental for basic DNS resolution and are certainly included in a zone transfer, they primarily provide host-to-IP mapping without specifying the type of service running on that IP. Although valuable for host enumeration, they do not offer the same targeted insight into specific critical services, such as email infrastructure, that MX records provide, making them less uniquely indicative of a specific attack vector from a zone transfer's output.
- ✗
NS record
Why it's wrong here
An NS (Name Server) record identifies the authoritative DNS name servers for a domain or zone, delegating DNS resolution responsibilities. These records are typically publicly available and are often discovered before attempting a zone transfer to identify the target name servers. While NS records are part of the zone file and would be included in a transfer, their primary purpose is DNS delegation, and they do not reveal specific service infrastructure like email servers or web hosts in the granular detail that MX or A records do.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.