312-50 Question 43
Single answer▪ DNS FootprintingDuring an authorized external reconnaissance engagement, you are asked to map the public-facing DNS infrastructure of examplecorp.com without sending unnecessary traffic to web servers. You already identified ns1.examplecorp.com and ns2.examplecorp.com as the domain's authoritative name servers. Which action would be the MOST appropriate next step to gather additional hostnames and email-routing information through DNS footprinting?
- A
Query the authoritative name servers directly for MX, NS, and TXT records for examplecorp.com, and attempt a zone transfer only if it is explicitly authorized and likely permitted
- B
Run a full TCP port scan against every IP in the target's /24 range because DNS servers usually reveal mail servers through open ports
- C
Send repeated recursive queries to a public resolver such as 8.8.8.8 instead of querying the authoritative name servers, because public resolvers provide more complete internal DNS data
- D
Perform ARP discovery against the target domain to enumerate DNS hostnames and mail exchangers from Layer 2 responses
Show answer and explanation
Correct answer: A
Explanation
The best answer is to query the authoritative name servers directly for DNS records relevant to infrastructure mapping, especially NS, MX, and TXT. In practical CEH-style reconnaissance, DNS footprinting focuses on extracting publicly exposed information from DNS to identify hosts, mail systems, and security-related metadata such as SPF entries in TXT records. If specifically authorized, a tester may also check for an open AXFR zone transfer, since a misconfigured name server could disclose the full zone. However, this is a discrete DNS test, not a substitute for normal record queries.
This approach is consistent with how DNS works: authoritative name servers hold the published source-of-truth data for the zone, while recursive resolvers mainly cache and relay answers. RFC 1034 and RFC 1035 define the DNS concepts and record handling, and AXFR zone transfer behavior is defined in later DNS specifications such as RFC 5936. In a real engagement, querying authoritative servers minimizes unnecessary traffic to unrelated systems and produces more reliable DNS footprinting results than broad port scans or unrelated network-layer techniques.
- A. Correct.
Correct. In DNS footprinting, once the authoritative name servers are known, querying them for records such as NS, MX, and TXT is a practical next step because these records can reveal delegated name servers, mail exchangers, SPF-related data, and other externally published service information. If the rules of engagement allow it, testing whether AXFR zone transfer is misconfigured can also reveal a large amount of DNS data, but it should be attempted carefully and only when explicitly authorized. This approach is targeted, low-noise, and aligned with reconnaissance best practices.
- B. Incorrect.
Incorrect. A full TCP port scan of an address range is not the most appropriate next step for DNS footprinting when the goal is to gather DNS-derived hostnames and email-routing information. Port scanning may identify services, but it does not directly enumerate DNS records such as MX, NS, or TXT. It also generates more noise than necessary, which contradicts the scenario's requirement to avoid unnecessary traffic.
- C. Incorrect.
Incorrect. Public recursive resolvers like 8.8.8.8 can answer cached DNS queries, but they are not the best primary source for authoritative footprinting. They do not provide 'more complete internal DNS data,' and they will only return publicly resolvable information. For accurate and direct reconnaissance of a target's published DNS configuration, the authoritative name servers are the preferred source.
- D. Incorrect.
Incorrect. ARP is a Layer 2 protocol used for resolving IP addresses to MAC addresses on a local network segment. It cannot be used across the public internet to enumerate DNS hostnames or MX records for a remote domain. This option reflects a protocol-layer misunderstanding that sometimes appears in reconnaissance questions.