Skip to main content
protocols.pageprotocols.page
53

Port 53 – DNS

TCP/UDP

Port 53 is the DNS port. UDP port 53 handles standard queries – fast and low overhead. TCP port 53 is used for zone transfers and when responses exceed 512 bytes (EDNS0 allows larger UDP). DNS over HTTPS (DoH) uses port 443 instead, encrypting queries.

Port Number

53

Protocol

TCP/UDP

Service

Domain Name System

Range

IANA Well-Known (0–1023)

Description

DNS uses UDP port 53 for most queries due to the low overhead of UDP. TCP port 53 is required for AXFR zone transfers between nameservers and for DNS responses too large for UDP (though EDNS0 increases the limit). Blocking TCP port 53 can cause issues with DNSSEC and large TXT records.

Security risks

  • 1DNS amplification DDoS: open resolvers on port 53 amplify small queries into large responses directed at victims. ANY queries produce 50-70x amplification. Restrict recursion to authorized clients only (allow-recursion in BIND).
  • 2DNS cache poisoning (Kaminsky attack): forged responses injected into recursive resolver caches redirect users to attacker IPs. DNSSEC validates responses cryptographically. Enable DNSSEC validation on all resolvers.
  • 3DNS tunneling: attackers encode data in DNS queries/responses to exfiltrate data through firewalls that allow port 53. Tools: iodine, dnscat2. Monitor for unusually long subdomain labels and high query volumes to single domains.
  • 4Zone transfer leakage: unrestricted AXFR on TCP 53 exposes your entire DNS zone (all hostnames, internal IPs). Restrict zone transfers to secondary nameserver IPs only (allow-transfer in BIND).

Firewall guidance

Allow UDP/TCP 53 inbound only on authoritative nameservers and designated internal resolvers. Block outbound UDP 53 from all hosts except your resolvers to prevent DNS tunneling exfiltration. Internal clients should use your resolvers (which query upstream), not query external DNS directly. Use DNS over HTTPS (port 443) or DNS over TLS (port 853) for encrypted resolution.

Diagnosis commands

Basic DNS resolution test against a specific server

shell
dig @server example.com A +short

Attempt zone transfer – should fail unless you are an authorized secondary

shell
dig @server example.com AXFR

Capture DNS traffic for debugging resolution issues

shell
tcpdump -i eth0 port 53 -nn

Verify DNSSEC validation is working (ad flag = authenticated data)

shell
dig +dnssec example.com A | grep -E '(ad|RRSIG)'

Usage examples

Port 53 – DNS
shell
dig @8.8.8.8 example.com A
nslookup example.com 8.8.8.8
nc -u 8.8.8.8 53

Common services on this port

BIND (named)UnboundPowerDNSCoreDNSdnsmasqKnot DNSWindows DNS Server

Related ports

853

DNS over TLS (DoT)

443

DNS over HTTPS (DoH)

5353

mDNS (multicast DNS)

History

DNS was introduced in RFC 882/883 (1983) by Paul Mockapetris to replace the manually-maintained HOSTS.TXT file. RFC 1035 (1987) standardized the current protocol. DNSSEC (RFC 4033, 2005) added cryptographic authentication. DNS over HTTPS (RFC 8484, 2018) and DNS over TLS (RFC 7858, 2016) added privacy.

FAQ

Why does DNS use both UDP and TCP on port 53?

UDP for speed (single round-trip for most queries). TCP for reliability when responses exceed UDP limits (large DNSSEC responses, zone transfers). EDNS0 extended UDP to 4096 bytes, but TCP remains required for AXFR and responses that exceed even that.

Should I block TCP port 53?

No. Blocking TCP 53 breaks DNSSEC (large signed responses), zone transfers to your secondaries, and any DNS response over ~1400 bytes. Many operators incorrectly block TCP 53 thinking only UDP matters – this causes intermittent resolution failures.

Specification

RFC 1035 – Port 53 specification →