Port 53 (DNS)

Domain Name System. UDP 53 carries ordinary queries; TCP 53 is used for responses too large for UDP, zone transfers (AXFR/IXFR) and by clients that retry over TCP.

Well-known (system) port, 0-1023 TCPUDP Network infrastructure Meant to face the internet

What port 53 is used for

Domain Name System. UDP 53 carries ordinary queries; TCP 53 is used for responses too large for UDP, zone transfers (AXFR/IXFR) and by clients that retry over TCP.

Security: should port 53 be open?

Meant to face the internet. Authoritative servers must answer the world on both UDP and TCP 53. Recursive resolvers must not: an open resolver gets abused for DNS amplification DDoS. Restrict recursion to your own networks and restrict zone transfers to your secondaries.

IANA assignment

Service nameProtoDescriptionAssigneeReference

domain TCP Domain Name Server Paul Mockapetris -

domain UDP Domain Name Server Paul Mockapetris -

Check what is listening on port 53

Linux: is anything listening on TCP 53?

sudo ss -tlnp 'sport = :53'

Linux: UDP 53

sudo ss -ulnp 'sport = :53'

Linux / macOS: which process owns the port

sudo lsof -nP -i :53

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':53 '

Windows (Command Prompt)

netstat -ano | findstr :53

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 53 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 53

From Windows

Test-NetConnection HOST -Port 53

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 53

Open port 53 in the firewall

ufw

sudo ufw allow 53/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT

nftables

sudo nft add rule inet filter input tcp dport 53 accept

Windows Firewall

New-NetFirewallRule -DisplayName 'Allow TCP 53' -Direction Inbound -Protocol TCP -LocalPort 53 -Action Allow

ufw

sudo ufw allow 53/udp