Port 853 DNS over TLS – Free, Online, Private

What listens on 853

Port 853 is encrypted DNS. The IANA name is domain-s, DNS query-response protocol, assigned in 2015. RFC 7858 defines DNS over TLS on TCP 853: the client opens TLS first, then sends DNS messages on that session. RFC 9250 defines DNS over QUIC on UDP 853. Those are different protocols that share a number. A firewall rule that allows only one transport allows only one of them. Port 53 is still the cleartext, and sometimes DNSSEC, query port. Moving a stub resolver to 853 does not move the authoritative server that the resolver talks to, unless that path is also configured for DoT or DoQ.

The IANA service name is domain-s: DNS query-response protocol run over TLS (TCP) or DTLS/QUIC (UDP). The practical transport is TCP and UDP. The checks below include both TCP and UDP, because both transports matter for this service. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 853

Service notes for port 853: the IANA name is domain-s (DNS query-response protocol run over TLS (TCP) or DTLS/QUIC (UDP)), and the program people mean is DNS over TLS. Port 853 is the IANA domain-s port. DNS over TLS uses TCP. DNS over QUIC uses UDP. Ordinary DNS stays on 53. DoT encrypts the query against a passive observer on the path to the resolver. It does not hide the query from the resolver. Pin or validate the certificate name. A client that accepts any certificate will send its queries to whoever answers 853. Do not leave a recursive resolver on 853 open to the internet any more than you would on 53. Reflection is harder over TLS, and it is not the point. The point is that an open resolver is still an open resolver. Authoritative servers generally stay on 53. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 853, you are on the wrong page.

A client set to 'DNS over TLS' that still points at port 53 fails the handshake or sends cleartext, depending on the implementation. Match the port to the mode. A second failure is TCP 853 allowed and UDP 853 blocked, which breaks DoQ and leaves DoT working, so a test with kdig or openssl looks fine while a DoQ client times out. A third is systemd-resolved or a browser using its own DoH endpoint on 443, so the listener you started on 853 is not the one the machine is using. Check the stub config, not only the socket.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 853 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. TCP 853 should complete a TLS handshake and present a certificate whose name matches the resolver. UDP 853 is DoQ and will not show a TCP LISTEN state. dig without +tls talks to 53 even if you pass a host that also has 853.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• 853 is not a replacement number for ordinary DNS. Port 53 remains the cleartext DNS port.
• TCP and UDP on 853 are different protocols, DoT and DoQ.
• DNS over HTTPS is usually TCP 443, not 853.
• A TLS failure on 853 is a certificate or protocol problem, not proof the port is closed.

Linuxsudo ss -lptn 'sport = :853'
sudo lsof -nP -iTCP:853 -sTCP:LISTEN
sudo ss -lpun 'sport = :853'
sudo lsof -nP -iUDP:853

macOSsudo lsof -nP -iTCP:853 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.853[^0-9]'
sudo lsof -nP -iUDP:853
netstat -anv -p udp | grep '\.853[^0-9]'

Windowsnetstat -ano | findstr :853
Get-NetTCPConnection -LocalPort 853
Get-NetUDPEndpoint -LocalPort 853

Remotenc -vz host 853
nc -vzu host 853