At an agency, a DNS query requests a TXT record whose name is a long random label, and the answer returned for that name is long as well. What suspicious use do that query and that answer support?
Select an answer to reveal the explanation.
Short Explanation
Hiding a note in the address on the envelope, then getting a long note back, is not a normal street lookup. You are looking at a TXT query with a long random name and a long answer, which can carry tunneled data. The trap is a plain address record, a mail relay, or an ARP announcement.
Full Explanation
DNS tunneling hides other data in query names and in answers, and a TXT record can carry a long payload in both directions. A long random label plus a long TXT answer supports Possible DNS tunneling, with the long label and the long answer carrying non-lookup data. A normal address lookup of type A only, the record used to map a name to an IPv4 address, is a different query type, and this query asked for TXT rather than an address record. An SMTP relay handing the same content to a mail server for delivery to a mailbox is mail transfer, and nothing here shows mail commands. An ARP announcement binding an IP address to a MAC address on the local segment is a layer-2 mapping, not a DNS TXT exchange. Length by itself does not make a TXT record hostile, so compare this random label and this long answer with the host's ordinary lookups. Exam caveat: some legitimate TXT answers are long, including mail-authentication records, so length alone is not proof; the random label paired with the long answer is the lead. Operational check: compare this query's name and TXT payload with the host's usual lookups, and look for many unique labels from that same host.