CEH Footprinting, Reconnaissance and Scanning Practice Question
During a security assessment, you execute: dnsenum --enum example.com. The tool returns results including the nameservers (NS), mail servers (MX), and performs a zone transfer attempt. The zone transfer fails. What is the MOST likely reason for the failure?
⚠ Common exam trap
Many exam-takers confuse the port used for zone transfers (TCP 53) with the standard DNS query port (UDP 53) or mistakenly think a failed zone transfer implies the server is down or the domain is invalid, rather than recognizing it as a deliberate security control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DNS server is configured to deny zone transfers from unauthorized hosts
DNS zone transfers (AXFR) are typically restricted by default on authoritative DNS servers to prevent unauthorized disclosure of the entire zone file. The `dnsenum` tool attempts an AXFR query over TCP port 53, and the failure indicates the server explicitly denied the request, which is a standard security configuration per RFC 5936.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS server is not running
Why it's wrong here
The successful retrieval of Name Server (NS) and Mail Exchanger (MX) records by `dnsenum` explicitly indicates that the DNS server is operational and responding to queries. If the server were not running, `dnsenum` would fail to resolve even these fundamental records, resulting in a connection error or a complete lack of output rather than a specific failure during the zone transfer attempt.
- ✗
The zone transfer requires TCP port 443
Why it's wrong here
DNS zone transfers, whether full (AXFR) or incremental (IXFR), exclusively utilize TCP port 53 for reliable, multi-packet data exchange between DNS servers. TCP port 443 is universally reserved for HTTPS traffic, which encrypts web communication, and has no functional role in the DNS protocol's mechanism for transferring zone data. Therefore, the port specified is incorrect for this operation.
- ✓
The DNS server is configured to deny zone transfers from unauthorized hosts
Why this is correct
When `dnsenum` successfully enumerates NS and MX records but subsequently fails to perform a zone transfer, it is a clear indication that the DNS server is active and the domain exists, but it is specifically configured to deny zone transfer requests from unauthorized hosts. This is a standard and recommended security practice, often implemented via `allow-transfer` directives, to prevent attackers from obtaining a full list of domain records.
- ✗
The domain does not exist
Why it's wrong here
The fact that `dnsenum` was able to retrieve Name Server (NS) and Mail Exchanger (MX) records for the domain unequivocally confirms its existence and active DNS configuration. If the domain did not exist, the tool would return an NXDOMAIN error or a similar indication that the domain could not be resolved, rather than successfully querying and displaying initial record types.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.