Port 53: DNS

What uses port 53

Most DNS queries are single UDP packets to port 53. TCP port 53 is used when a response is too big for UDP (large DNSSEC records, many TXT records) and for zone transfers between DNS servers, so both must be open on a DNS server. Encrypted alternatives exist: DNS over TLS on 853 and DNS over HTTPS on 443.

Should port 53 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

• A resolver that answers recursive queries from anyone (an open resolver) gets abused for DDoS amplification. Allow recursion only for your own networks.
• On Ubuntu, systemd-resolved listens on 127.0.0.53:53, which is why another DNS server (dnsmasq, Pi-hole) fails with “address already in use”. Disable its stub listener with DNSStubListener=no.

Check what is listening on port 53

sudo ss -ltnp 'sport = :53'
sudo ss -lunp 'sport = :53'

sudo lsof -nP -iTCP:53 -sTCP:LISTEN
sudo lsof -nP -iUDP:53

Get-NetTCPConnection -LocalPort 53 -State Listen
Get-NetUDPEndpoint -LocalPort 53
netstat -ano | findstr :53

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 53

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:53 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 53 -State Listen).OwningProcess

Allow port 53 from trusted networks only

The examples allow 53 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 53 proto udp
sudo ufw allow from 10.0.0.0/8 to any port 53 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 53 proto udp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="53" protocol="udp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="53" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "DNS 53/UDP" -Direction Inbound -Protocol UDP -LocalPort 53 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "DNS 53/TCP" -Direction Inbound -Protocol TCP -LocalPort 53 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 53 from another machine

nc -zv example.com 53

Test-NetConnection example.com -Port 53

Related ports

• Port 853 (DNS over TLS): used by DNS over TLS (DoT) for encrypted DNS queries.
• Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.
• Port 5353 (mDNS): used by multicast DNS for discovering devices on a local network.
• Port 67 (DHCP server): where DHCP servers listen for requests from devices that need an IP address.

More network services ports

68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 389 (LDAP) , 636 (LDAPS) . See all ports in the port lookup.

Sources

• IANA port registry: 53

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions