Network ports · 53
53 — DNS
Port 53 resolves domain names, over UDP for queries and TCP for large answers or zone transfers.
Key facts
| Port | 53 |
|---|---|
| Transport | UDP and TCP |
| Service | Domain Name System |
| UDP use | Normal queries and responses |
| TCP use | Large responses, zone transfer |
| Range | Well-known (0–1023) |
Why DNS needs two transports
Most queries are small enough for a single UDP datagram, which avoids connection setup. When a response exceeds the UDP size the client can accept, the server sets the truncated bit and the client retries over TCP. DNSSEC responses and large record sets trigger this regularly.
Firewalls that allow only UDP 53 produce intermittent failures that look like random timeouts. Allow both transports if you run or reach a DNS server directly.
Encrypted DNS
DNS over HTTPS carries queries inside HTTPS, usually on port 443. DNS over TLS uses a dedicated TLS connection on port 853. Both hide queries from the local network but move trust to the resolver you choose.
Authoritative servers still speak classic DNS on 53; encryption applies to the path between a client and a recursive resolver. Zone transfers should be restricted to known secondary servers.
Frequently asked questions
Is port 53 TCP or UDP?
Both. UDP carries most queries; TCP handles large responses and zone transfers.
Does DNS over HTTPS use port 53?
No. DoH uses HTTPS, normally port 443. DoT uses port 853.