DNS, Web and Mail Services practice questions

The partner's SPF record is misconfigured, causing Postfix to reject the email.

Why wrong: SPF misconfiguration would cause a different error, not a reference to a DNSBL. The error clearly points to a block related to the client host, likely a reverse DNS issue.

The partner's IP is listed on a local DNSBL that is aggregated with zen.spamhaus.org.

Why wrong: The IP is not listed on any public DNSBL, and an aggregated local DNSBL would still result in a similar block but the question states it's not listed on any public DNSBL, so this is not the cause.

The mail server is using greylisting and the partner's server has not retried.

Why wrong: Greylisting produces a temporary failure (4xx), not a permanent 550 error, and does not reference a DNSBL.

zone "example.com" { type master; file "db.example.com"; update-policy { grant 192.168.1.0/24 zonesub ANY; }; };

Why wrong: update-policy is used for fine-grained access control typically with TSIG keys, not for IP-based grants.

zone "example.com" { type master; file "db.example.com"; allow-transfer { 192.168.1.0/24; }; };

Why wrong: allow-transfer controls zone transfers, not dynamic updates.

zone "example.com" { type master; file "db.example.com"; also-notify { 192.168.1.0/24; }; };

Why wrong: also-notify specifies additional servers to notify, unrelated to dynamic updates.

Enable logging for all virtual hosts to identify the source of requests.

Why wrong: Wrong. Enabling logging adds overhead and does not reduce load; it only helps identify sources after the fact.

Increase the MaxClients directive to allow more concurrent connections.

Why wrong: Wrong. Increasing MaxClients allows more concurrent connections but does not prevent unwanted requests from consuming resources.

Disable KeepAlive to reduce the number of requests per connection.

Why wrong: Wrong. Disabling KeepAlive reduces overhead per connection but does not specifically address requests for non-existent hosts.

The company's mail server is not authorized to relay mail for the internal clients, causing a deferral.

Why wrong: Relay authorization failures produce 'Relay access denied' errors, not connection timeouts.

The DNS MX record for example.org is misconfigured, pointing to a non-existent host.

Why wrong: If MX record pointed to non-existent host, Postfix would get a DNS resolution failure, not a connection timeout.

The remote server is rate limiting connections from the company's mail server.

Why wrong: Rate limiting typically produces a temporary failure after connection is established, not a timeout.

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Why wrong: allow-transfer restricts zone transfers, not recursion.

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Why wrong: blackhole discards queries from certain sources, but does not prevent cache poisoning; DNSSEC does.

The 'forwarders' option can be used to disable recursion entirely.

Why wrong: forwarders only redirect queries; recursion can be disabled with 'recursion no'.

Check the 'allow-transfer' ACL on the master; it might be restricting transfers to the slaves.

Why wrong: The logs show 'Transfer started', so the master allowed the connection; the problem is the transfer not completing, possibly due to data transfer issues.

Increase the serial number again on the master to a higher value and wait for the slaves to refresh.

Why wrong: The slaves are not contacting the master, likely because they haven't received a NOTIFY. Increasing serial number alone won't trigger a transfer without a NOTIFY or refresh interval.

Restart the BIND service on the slave servers.

Why wrong: Restarting slaves might cause them to check the serial number at startup, but it is not guaranteed and may cause brief downtime.

NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.

Why wrong: NSEC3 records are stored in hash order, not plain text order.

The NSEC3 record type is NXT and is used to provide authenticated denial of existence.

Why wrong: NXT is the DNSSEC record for NSEC, not NSEC3.

NSEC3 uses SHA-256 as the default hash algorithm.

Why wrong: NSEC3 uses SHA-1 by default.

The server's firewall is blocking outbound connections on port 25, causing connection timeouts.

Why wrong: Blocking port 25 would cause immediate connection failures, not deferral after acceptance.

The SPF record for the sender domain is missing, causing the recipient's mail server to reject the email.

Why wrong: SPF failure would cause rejection, not deferral, and would appear in logs.

The server's IP address has no PTR record, causing the recipient's mail server to reject the connection.

Why wrong: PTR records are not checked during initial delivery; deferral would not occur.

1. Install LDAP authentication packages; 2. Modify nsswitch.conf to use ldap; 3. Configure LDAP client settings; 4. Modify PAM configuration to include pam_ldap; 5. Restart services and test authentication.

Why wrong: This order is incorrect because modifying nsswitch before configuring the LDAP client could cause name resolution failures if the client isn't properly set up to connect to the LDAP server.

1. Modify PAM configuration to include pam_ldap; 2. Install LDAP authentication packages; 3. Configure LDAP client settings; 4. Modify nsswitch.conf to use ldap; 5. Restart services and test authentication.

Why wrong: This order is incorrect because PAM modifications require the packages to be installed first; attempting to modify PAM before installation would fail or have no effect.

1. Install LDAP authentication packages; 2. Configure LDAP client settings; 3. Modify PAM configuration to include pam_ldap; 4. Modify nsswitch.conf to use ldap; 5. Restart services and test authentication.

Why wrong: This order is incorrect because nsswitch must be modified before PAM; PAM relies on nsswitch to resolve user identities, so changing PAM first without nsswitch pointing to LDAP would result in authentication failures.

kernel.shmmax: Sets the maximum number of file handles

Why wrong: Incorrect — kernel.shmmax sets the maximum size of a shared memory segment, not file handles.

fs.file-max: Controls the maximum amount of shared memory

Why wrong: Incorrect — fs.file-max sets the maximum number of file handles, not shared memory.

The zone file lacks an MX record.

Why wrong: An absent MX record would cause failure for both internal and external users.

The server is behind a firewall that blocks UDP port 53.

Why wrong: A firewall blocking port 53 would affect both internal and external users equally.

The recursion is set to no.

Why wrong: Disabling recursion is normal for authoritative servers and does not block queries; it only prevents recursive lookups.

The filesystem containing the mail spool is out of inodes.

Why wrong: Out of inodes would cause a 'No space left on device' error, not a mailbox lock.

The disk quota for the user has been exceeded.

Why wrong: Quota exceeded errors are reported as 'mailbox is full' or 'quota exceeded', not 'mailbox is locked'.

The Postfix process lacks write permission to the mailbox.

Why wrong: Permission issues typically result in 'permission denied' errors, not 'mailbox is locked'.

mod_proxy

Why wrong: mod_proxy is used to proxy requests to another server, not for URL rewriting.

mod_alias

Why wrong: mod_alias provides simple URL mapping but not rule-based rewriting.

mod_redirect

Why wrong: mod_redirect is not a standard Apache module; redirects are implemented by mod_alias or mod_rewrite.

NSEC

Why wrong: NSEC records are used for authenticated denial of existence but are not strictly essential for basic DNSSEC; DNSKEY and RRSIG are core.

A

Why wrong: A record is a regular resource record, not essential for DNSSEC.

SOA

Why wrong: SOA record is not specific to DNSSEC; it exists in all zones.

smtpd_tls_auth_only

Why wrong: This parameter forces authentication only over TLS but is not required for SASL.

smtp_sasl_auth_enable

Why wrong: This parameter enables SASL for outgoing mail, not incoming.

Add a CNAME record for ftp pointing to www.example.com.

Why wrong: Adding a CNAME for 'ftp' pointing to 'www.example.com' fails because it only creates an alias, and the problem implies 'ftp.example.com' needs its own distinct IP address to resolve the NXDOMAIN, likely for an FTP server. This option is tempting because CNAME records are used to map one hostname to another. It would be the correct choice if 'ftp.example.com' was intended to be an alias for 'www.example.com', resolving to the same IP address as the web server.

Increase the serial number in the SOA record.

Why wrong: Increasing serial notifies secondaries but does not create missing records.

Ensure recursion is enabled on the server.

Why wrong: Recursion is not needed; the server is authoritative for the zone.

The filesystem containing the logs is full.

Why wrong: A full filesystem would affect log file creation, but the error is specifically about a rewrite_log_lock, which uses semaphores.

The server is out of memory.

Why wrong: Out of memory would cause swapping or OOM killer, not a 'No space left on device' error.

The RewriteMap file specified is missing.

Why wrong: A missing RewriteMap would produce a different error, not a lock error.

The reverse zone is not delegated.

Why wrong: Delegation is not indicated; the server is authoritative.

The query should be for 1.2.0.192.in-addr.arpa.

Why wrong: The query syntax is correct; -x automatically constructs the correct format.

The server is not authoritative for the reverse zone.

Why wrong: The authority section shows SOA for 2.0.192.in-addr.arpa, indicating it is authoritative.

myhostname

Why wrong: myhostname sets the server's hostname, not the domain for appending.

mydomain

Why wrong: mydomain sets the local domain but does not automatically append it to unqualified addresses.

mydomainname

Why wrong: mydomainname is not a valid Postfix parameter.

IP-based virtual hosting

Why wrong: Requires multiple IP addresses, which may not be available.

Port-based virtual hosting

Why wrong: Requires different ports, which is not standard for web browsing.

Using mod_rewrite for each domain

Why wrong: mod_rewrite is for URL manipulation, not for virtual hosting.