312-50 Question 45
Single answer▪ DNS FootprintingDuring an authorized reconnaissance phase, you are asked to identify the authoritative name servers and mail infrastructure for examplecorp.com while minimizing noise and avoiding direct interaction with web servers or endpoint hosts. Which DNS footprinting approach is the most appropriate to gather this information reliably?
- A
Query the domain's DNS records for NS and MX entries using a tool such as dig or nslookup
- B
Perform a full TCP port scan of the target subnet to identify systems listening on port 53 and 25
- C
Run a zone transfer (AXFR) request against the domain and assume it will succeed if recursion is enabled
- D
Use traceroute to the company's website and infer the mail servers from intermediate hops
Show answer and explanation
Correct answer: A
Explanation
For DNS footprinting, the most accurate and least intrusive way to identify authoritative name servers and mail infrastructure is to query DNS specifically for NS and MX records. This is a classic reconnaissance technique used in ethical hacking engagements before considering more active methods. For example, dig examplecorp.com NS and dig examplecorp.com MX return the designated authoritative name servers and mail exchangers published for the domain. By contrast, port scanning is broader and noisier, traceroute does not reveal DNS role assignments, and AXFR zone transfers are only useful when explicitly permitted by server configuration. According to common DNS operational practice and documentation such as BIND Administrator Reference materials and standard DNS behavior defined in RFCs for DNS resource records, NS records identify authoritative name servers for a zone and MX records identify mail exchangers for the domain. A key best practice in reconnaissance is to start with the least intrusive, most targeted collection method that directly answers the question.
- A. Correct.
Correct. Querying NS and MX records is a standard, low-noise DNS footprinting technique for identifying authoritative name servers and mail exchangers. Tools such as dig, nslookup, or host can directly request these record types from public DNS infrastructure without touching application servers or scanning endpoints. This aligns with the goal of collecting DNS intelligence efficiently during reconnaissance.
- B. Incorrect.
Incorrect. A subnet-wide port scan is much noisier and broader than necessary for this objective. It may identify DNS or mail services, but it does not directly answer which hosts are authoritative name servers for the domain or which systems are designated as mail exchangers in DNS. In CEH-style reconnaissance, querying DNS records is the more precise and appropriate first step.
- C. Incorrect.
Incorrect. An AXFR zone transfer can sometimes reveal extensive DNS information, but it should not be assumed to work, and recursion is unrelated to whether a server permits zone transfers. AXFR is controlled by zone transfer policies on authoritative servers, typically restricted to authorized secondary servers. Confusing recursion with zone transfer permissions is a common misconception.
- D. Incorrect.
Incorrect. Traceroute shows network paths to a destination, not DNS mail exchanger assignments. Intermediate hops usually represent routers and transit devices, not the organization's MX infrastructure. Inferring mail servers from traceroute output is unreliable and not a valid DNS footprinting method for this purpose.