A help-desk ticket says that some DNS queries are timing out after a recent rollout of DNSSEC validation on the company's caching resolver. A packet capture from a Linux workstation behind the corporate firewall shows this sequence:
The client sends a UDP query; the resolver replies with the TC flag set (response truncated).
The client immediately retries the same query over TCP port 53 but never receives a SYN-ACK.
When the user connects through a VPN that bypasses the firewall, the identical query succeeds.
Simple A-record lookups that fit in a single UDP packet continue to work normally.
Based on these observations, which configuration issue is most likely causing the failures?
The DHCP server handed out an incorrect default gateway, forcing the client to send DNS traffic to an unreachable network.
EDNS0 support has been disabled on the recursive resolver, preventing it from sending OPT records in queries.
The workstation's search domain list contains more than six entries, causing the resolver to discard DNSSEC responses.
The corporate firewall is filtering DNS traffic on TCP port 53, so truncated queries cannot be retried over TCP.
DNS uses UDP port 53 for most queries, but the protocol requires a resolver to retry over TCP when a UDP response is truncated or when DNSSEC data pushes the payload beyond the 512-byte limit (or the advertised EDNS0 buffer size). In the scenario, the TCP three-way handshake never completes, which means the SYN packet is leaving the network but the SYN-ACK is being filtered or dropped. Because the fallback connection cannot be established, the resolver ultimately returns SERVFAIL or times out for any name whose response is larger than the firewall allows. Therefore, a rule that blocks DNS over TCP 53 is the most plausible root cause. The other options either affect how the resolver builds queries (search list, EDNS0) or unrelated network settings (DHCP gateway) and would not selectively break only large, truncated responses.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why does DNS use both UDP and TCP, and when is TCP used?
Open an interactive chat with Bash
What is DNSSEC, and how does it affect query size?
Open an interactive chat with Bash
What is EDNS0, and how does it improve DNS query capabilities?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Troubleshooting
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access