CEH Footprinting and Reconnaissance Practice Question

Exhibit

Refer to the exhibit.
```
C:\Users\test>nslookup -type=MX example.com
Server:  dns.company.com
Address:  192.168.1.1

example.com     MX preference = 10, mail exchanger = mail1.example.com
example.com     MX preference = 20, mail exchanger = mail2.example.com
```

What can be inferred from the output?

⚠ Common exam trap

A common mix-up: candidates confuse MX records with other DNS record types (like A or TXT) and incorrectly infer unrelated information such as SPF usage or web server IPs, or assume the command failed when it clearly succeeded.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The domain has two mail servers with different priority levels.

The output shows two MX records for the domain, each with a different priority value (e.g., 10 and 20). Lower priority numbers indicate higher preference, so the mail server with priority 10 is tried first, and the one with priority 20 is a backup. This directly indicates the domain has two mail servers with different priority levels, which is exactly what MX records are designed to convey.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The domain has two mail servers with different priority levels.
Why this is correct
The output from a DNS query for MX records explicitly shows multiple entries, each specifying a mail exchanger (mail server) and an associated preference value. These preference values, such as 10 and 20, dictate the order in which sending mail servers should attempt delivery, with lower numbers indicating higher priority. This configuration confirms the existence of two distinct mail servers and establishes a prioritized delivery mechanism, providing both redundancy and a defined failover sequence for incoming email.
✗
The command failed because the DNS server is unreachable.
Why it's wrong here
A command failure due to an unreachable DNS server would typically manifest as an explicit error message, such as a timeout or a 'host not found' indication, rather than a successful return of data. The presence of MX records in the output unequivocally demonstrates that the DNS server was successfully queried and responded with the requested information. This successful interaction confirms the DNS server's reachability and its operational status at the time of the query.
✗
The domain uses SPF records to prevent email spoofing.
Why it's wrong here
SPF (Sender Policy Framework) records are a specific type of TXT record designed to combat email spoofing by authorizing which mail servers can send email on behalf of a domain. The provided output, which focuses exclusively on Mail Exchanger (MX) records, does not include any TXT records. Therefore, based solely on the presented information, one cannot accurately infer the presence or absence of SPF records for the domain.
✗
The domain's web server IP address is 192.168.1.1.
Why it's wrong here
The IP address 192.168.1.1, frequently observed in DNS query outputs, typically identifies the local DNS resolver or gateway used to perform the lookup, not the target domain's web server. The IP address for a domain's web server is found in its A (Address) records, or AAAA records for IPv6, which are distinct from the MX (Mail Exchanger) records displayed in this particular output. Inferring a web server IP from the resolver's address is a common misinterpretation of DNS query results.

Go deeper

CEH Footprinting and Reconnaissance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question