Port 53DNS

What port 53 is used for

Every time a program turns a name like example.com into an IP address, a DNS query goes to a resolver on port 53. The DNS record explains the resolution process; this page is about the port.

A firewall that allows UDP 53 but blocks TCP 53 causes intermittent failures for large responses, DNSSEC-signed zones and some DNS-based services.

Encryption

Classic DNS is unencrypted and unauthenticated. Anyone on the path can read which names a client resolves and can forge answers unless DNSSEC validation is in place. Two encrypted alternatives use different ports:

• DNS over TLS (DoT) — TCP 853. Supported by Android, some routers and resolvers such as 1.1.1.1 and 9.9.9.9.
• DNS over HTTPS (DoH) — TCP/UDP 443, indistinguishable from web traffic. Used by browsers and Windows 11's DNS client when configured.

These protect the client-to-resolver leg only; the resolver still queries authoritative servers on port 53.

Security considerations

• Recursive resolvers should not be open to the internet. An open resolver is used for amplification attacks, in which small spoofed queries produce large responses aimed at a victim. Restrict recursion to your own networks.
• Authoritative servers must be reachable on both UDP and TCP 53 from anywhere, but should refuse recursion.
• Zone transfers (TCP 53) should be limited to secondary servers by address or TSIG key.
• DNS is a covert channel. Malware tunnels data through DNS queries. Logging and rate-limiting queries from workstations helps detect it.

How to check port 53

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :53

A line in the LISTENING state means a local program has bound port 53; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :53 or lsof -i :53.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection 1.1.1.1 -Port 53

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 53. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Query a specific server directly to test port 53 end to end:

nslookup example.com 1.1.1.1

Resolve-DnsName example.com -Server 1.1.1.1 -TcpOnly

The second command forces TCP, which confirms that TCP 53 is not blocked.

Firewall considerations

DNS servers need inbound UDP 53 and TCP 53. Everything else needs only outbound 53 to the resolvers it uses. Windows Defender Firewall does not need an inbound rule on workstations because the DNS Client service only sends queries.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 53 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.