DNS, Web and Mail Services practice questions

The partner's SPF record is misconfigured, causing Postfix to reject the email.

Why wrong: SPF failures typically produce errors like '550 5.7.1 Sender policy rejection' not 'cannot find your hostname'.

The partner's IP is listed on a local DNSBL that is aggregated with zen.spamhaus.org.

Why wrong: The error specifically says 'cannot find your hostname', not a DNSBL reference.

The mail server is using greylisting and the partner's server has not retried.

Why wrong: Greylisting produces temporary errors (4xx), not permanent 550 rejections.

zone "example.com" { type master; file "db.example.com"; update-policy { grant 192.168.1.0/24 zonesub ANY; }; };

Why wrong: update-policy is used for fine-grained access control typically with TSIG keys, not for IP-based grants.

zone "example.com" { type master; file "db.example.com"; allow-transfer { 192.168.1.0/24; }; };

Why wrong: allow-transfer controls zone transfers, not dynamic updates.

zone "example.com" { type master; file "db.example.com"; also-notify { 192.168.1.0/24; }; };

Why wrong: also-notify specifies additional servers to notify, unrelated to dynamic updates.

Enable logging for all virtual hosts to identify the source of requests.

Why wrong: Logging increases disk I/O and CPU usage, adding to the load.

Increase the MaxClients directive to allow more concurrent connections.

Why wrong: This would allow more connections, increasing load, not reducing.

Disable KeepAlive to reduce the number of requests per connection.

Why wrong: Disabling KeepAlive may increase the number of connections, potentially increasing load.

The company's mail server is not authorized to relay mail for the internal clients, causing a deferral.

Why wrong: Relay authorization failures produce 'Relay access denied' errors, not connection timeouts.

The DNS MX record for example.org is misconfigured, pointing to a non-existent host.

Why wrong: If MX record pointed to non-existent host, Postfix would get a DNS resolution failure, not a connection timeout.

The remote server is rate limiting connections from the company's mail server.

Why wrong: Rate limiting typically produces a temporary failure after connection is established, not a timeout.

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Why wrong: allow-transfer restricts zone transfers, not recursion.

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Why wrong: blackhole discards queries from certain sources, but does not prevent cache poisoning; DNSSEC does.

The 'forwarders' option can be used to disable recursion entirely.

Why wrong: forwarders only redirect queries; recursion can be disabled with 'recursion no'.

Check the 'allow-transfer' ACL on the master; it might be restricting transfers to the slaves.

Why wrong: The logs show 'Transfer started', so the master allowed the connection; the problem is the transfer not completing, possibly due to data transfer issues.

Increase the serial number again on the master to a higher value and wait for the slaves to refresh.

Why wrong: The slaves are not contacting the master, likely because they haven't received a NOTIFY. Increasing serial number alone won't trigger a transfer without a NOTIFY or refresh interval.

Restart the BIND service on the slave servers.

Why wrong: Restarting slaves might cause them to check the serial number at startup, but it is not guaranteed and may cause brief downtime.

NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.

Why wrong: NSEC3 records are stored in hash order, not plain text order.

The NSEC3 record type is NXT and is used to provide authenticated denial of existence.

Why wrong: NXT is the DNSSEC record for NSEC, not NSEC3.

NSEC3 uses SHA-256 as the default hash algorithm.

Why wrong: NSEC3 uses SHA-1 by default.

The server's firewall is blocking outbound connections on port 25, causing connection timeouts.

Why wrong: Blocking port 25 would cause immediate connection failures, not deferral after acceptance.

The SPF record for the sender domain is missing, causing the recipient's mail server to reject the email.

Why wrong: SPF failure would cause rejection, not deferral, and would appear in logs.

The server's IP address has no PTR record, causing the recipient's mail server to reject the connection.

Why wrong: PTR records are not checked during initial delivery; deferral would not occur.

The zone file lacks an MX record.

Why wrong: An absent MX record would cause failure for both internal and external users.

The server is behind a firewall that blocks UDP port 53.

Why wrong: A firewall blocking port 53 would affect both internal and external users equally.

The recursion is set to no.

Why wrong: Disabling recursion is normal for authoritative servers and does not block queries; it only prevents recursive lookups.

The filesystem containing the mail spool is out of inodes.

Why wrong: Out of inodes would cause a 'No space left on device' error, not a mailbox lock.

The disk quota for the user has been exceeded.

Why wrong: Quota exceeded errors are reported as 'mailbox is full' or 'quota exceeded', not 'mailbox is locked'.

The Postfix process lacks write permission to the mailbox.

Why wrong: Permission issues typically result in 'permission denied' errors, not 'mailbox is locked'.

mod_proxy

Why wrong: mod_proxy is used to proxy requests to another server, not for URL rewriting.

mod_alias

Why wrong: mod_alias provides simple URL mapping but not rule-based rewriting.

mod_redirect

Why wrong: mod_redirect is not a standard Apache module; redirects are implemented by mod_alias or mod_rewrite.

NSEC

Why wrong: NSEC records are used for authenticated denial of existence but are not strictly essential for basic DNSSEC; DNSKEY and RRSIG are core.

A

Why wrong: A record is a regular resource record, not essential for DNSSEC.

SOA

Why wrong: SOA record is not specific to DNSSEC; it exists in all zones.

smtpd_tls_auth_only

Why wrong: This parameter forces authentication only over TLS but is not required for SASL.

smtp_sasl_auth_enable

Why wrong: This parameter enables SASL for outgoing mail, not incoming.

Add a CNAME record for ftp pointing to www.example.com.

Why wrong: While this would work, it introduces a dependency; adding an A record is simpler and more direct.

Increase the serial number in the SOA record.

Why wrong: Increasing serial notifies secondaries but does not create missing records.

Ensure recursion is enabled on the server.

Why wrong: Recursion is not needed; the server is authoritative for the zone.

The filesystem containing the logs is full.

Why wrong: A full filesystem would affect log file creation, but the error is specifically about a rewrite_log_lock, which uses semaphores.

The server is out of memory.

Why wrong: Out of memory would cause swapping or OOM killer, not a 'No space left on device' error.

The RewriteMap file specified is missing.

Why wrong: A missing RewriteMap would produce a different error, not a lock error.

The reverse zone is not delegated.

Why wrong: Delegation is not indicated; the server is authoritative.

The query should be for 1.2.0.192.in-addr.arpa.

Why wrong: The query syntax is correct; -x automatically constructs the correct format.

The server is not authoritative for the reverse zone.

Why wrong: The authority section shows SOA for 2.0.192.in-addr.arpa, indicating it is authoritative.

myhostname

Why wrong: myhostname sets the server's hostname, not the domain for appending.

mydomain

Why wrong: mydomain sets the local domain but does not automatically append it to unqualified addresses.

mydomainname

Why wrong: mydomainname is not a valid Postfix parameter.

IP-based virtual hosting

Why wrong: Requires multiple IP addresses, which may not be available.

Port-based virtual hosting

Why wrong: Requires different ports, which is not standard for web browsing.

Using mod_rewrite for each domain

Why wrong: mod_rewrite is for URL manipulation, not for virtual hosting.