Port 53 DNS – Free, Online, Private

What listens on 53

Port 53 is DNS. The IANA name is domain, Domain Name Server. Ordinary lookups are a single UDP packet each way. The answer sets the TC bit when it does not fit, and the client retries over TCP. Zone transfers, AXFR, are TCP. DNSSEC answers are larger and fall over to TCP more often. A resolver that allows UDP and blocks TCP will look fine until a name needs the long answer, and then it will fail in a way that is hard to see from a small dig query. IANA assigns both transports. You need both.

The IANA service name is domain: Domain Name Server. The practical transport is TCP and UDP. The checks below include both TCP and UDP, because both transports matter for this service. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 53

Service notes for port 53: the IANA name is domain (Domain Name Server), and the program people mean is DNS. Port 53 is the IANA domain port. DNS queries use UDP, and they use TCP when the answer is truncated or the query is a transfer. An open resolver on 53 answers anyone and is used in reflection attacks, because the response is larger than the query. Recursors should answer only your clients. Authoritative servers answer the world for the zones they host and should still not recurse for the world. Rate limits and response-rate limiting cut reflection. Do not expose a recursive resolver on a public address. DNS-over-TLS is a different port, 853. Moving the public resolver to 53 'temporarily' is how an open resolver ships. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 53, you are on the wrong page.

Firewalls that allow UDP 53 and forget TCP 53 break transfers and large answers. Docker's embedded DNS and systemd-resolved both bind 53 on a loopback address, and a second resolver then fails to start. ss will show who won. A stub resolver on 127.0.0.53 is not your authoritative server. Another trap is testing with nc -vzu and treating silence as failure. UDP does not handshake. dig is the test that asks a real question.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 53 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. On a recursive host, the listener is often 127.0.0.53 or 127.0.0.1, which is correct and is not a public open resolver. On an authoritative host you want the public address, UDP and TCP. Confirm with dig @host example.com A and with a TCP query, dig +tcp.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• UDP alone is not a complete DNS allow. TCP 53 has to pass too.
• nc cannot prove a nameserver is healthy. dig can.
• Port 5353 is multicast DNS, a different service. Do not confuse the two.
• A process bound to 127.0.0.53 is a local stub. It is not evidence the host answers the internet.

Linuxsudo ss -lpun 'sport = :53'
sudo lsof -nP -iUDP:53
sudo ss -lptn 'sport = :53'
sudo lsof -nP -iTCP:53 -sTCP:LISTEN

macOSsudo lsof -nP -iUDP:53
netstat -anv -p udp | grep '\.53[^0-9]'
sudo lsof -nP -iTCP:53 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.53[^0-9]'

Windowsnetstat -ano | findstr :53
Get-NetUDPEndpoint -LocalPort 53
Get-NetTCPConnection -LocalPort 53

Remotenc -vzu host 53
nc -vz host 53