Port 53: DNS
Port 53 is DNS, and it genuinely uses both transports. Ordinary queries and answers go over UDP; TCP is used when a response is too large for a single UDP datagram, and for zone transfers between name servers.
| Port number | 53 |
|---|---|
| Service | Domain Name System |
| Protocol | TCP/UDP |
| Category | Core services |
| Default encryption | No |
| IANA service name | domain |
| IANA transports | TCP, UDP |
| Used in practice | TCP, UDP |
Is DNS TCP or UDP on port 53?
Both, and the split is functional rather than historical. A normal lookup is a single small question and a single small answer, so UDP is the right tool: no handshake, no connection state, one round trip.
The original specification capped a UDP DNS message at 512 bytes. If the answer did not fit, the server set the truncated flag and the client retried the same query over TCP, where message size is not a problem. EDNS(0) later let clients advertise a larger UDP buffer, which pushed the practical limit up and reduced the number of TCP retries, but it did not eliminate them.
Zone transfers, where a secondary name server pulls an entire zone from a primary, always use TCP because they can be arbitrarily large and need reliability. So do DNSSEC responses often enough to matter, since signatures make answers much bigger. Blocking TCP 53 is a classic cause of intermittent resolution failures that only affect some names.
Why is something already using port 53 on my machine?
On Linux desktops it is usually systemd-resolved, which runs a stub resolver bound to 127.0.0.53 on port 53. That is why starting your own DNS server can fail with an address-already-in-use error even though nothing appears to be listening on the machine's real address.
On a router or small network appliance it is normally dnsmasq, which typically serves DNS on port 53 and DHCP on ports 67 and 68 from the same process. On a Windows domain controller it is the DNS Server role, which Active Directory depends on and cannot simply be turned off.
Which ports are related to port 53?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 853 | encrypted | DNS over TLS, a dedicated encrypted port for the same queries. |
| 443 | encrypted | DNS over HTTPS does not get a port of its own; it hides inside ordinary HTTPS traffic on 443, which is precisely the point of it. |
| 5353 | companion | Multicast DNS, for resolving names on the local link with no server at all. |
What commonly listens on port 53?
- BIND, Unbound, Knot and NSD on Unix resolvers and authoritative servers
- dnsmasq on routers and small networks
- systemd-resolved bound to 127.0.0.53 on many Linux desktops
- Windows Server DNS on Active Directory domain controllers
How do I check whether port 53 is open?
Port 53 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 53 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 53 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':53 ' | Lists the process bound to port 53 on Linux. On macOS use lsof -nP -iTCP:53 -sTCP:LISTEN, on Windows netstat -ano | findstr :53 |
| Is it open on a remote host? | sudo nmap -sU -p 53 example.com | UDP has no handshake, so there is nothing to complete. nmap infers the state from whether an ICMP port-unreachable comes back, needs root, and is slow and easy to misread. A silent port may be open, filtered, or simply not replying to a probe it does not recognise. |
| What is listening locally? | ss -ulnp | grep ':53 ' | Shows the UDP socket bound to port 53. This is the reliable way to answer the question, because you are asking the host itself rather than guessing from outside. |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Does DNS use TCP or UDP on port 53?
Both. Standard queries use UDP 53 for speed, and TCP 53 is used when a response is too large for a single UDP datagram, for zone transfers between name servers, and often for DNSSEC-signed answers. Allow both in firewall rules; permitting only UDP causes intermittent failures on large responses.
What is the difference between port 53 and port 853?
Port 53 carries plain, unencrypted DNS that anyone on the network path can read or tamper with. Port 853 carries DNS over TLS, the same queries inside an encrypted, authenticated connection. DNS over HTTPS is a third option and uses port 443 rather than a port of its own.
What is port 53 used for?
Port 53 is DNS, and it genuinely uses both transports. Ordinary queries and answers go over UDP; TCP is used when a response is too large for a single UDP datagram, and for zone transfers between name servers.
Is port 53 TCP or UDP?
IANA assigns port 53 on TCP, UDP. In practice it carries TCP, UDP. One of the few well-known ports where both the TCP and the UDP registration are actively used, so a firewall rule that allows only UDP 53 will eventually break something.
Is port 53 secure?
Port 53 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 53 on my firewall?
Only if you specifically need DNS. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.