HTTPfy

Port 563 (NNTP over TLS)

Usenet over TLS.

Well-known (system) port, 0-1023 TCP Email Expose only to trusted sources

What port 563 is used for

Usenet over TLS.

Security: should port 563 be open?

Expose only to trusted sources. Use it instead of 119.

IANA assignment

Service nameProtoDescriptionAssigneeReference
nntps TCP nntp protocol over TLS/SSL (was snntp) IESG RFC 4642
nntps UDP nntp protocol over TLS/SSL (was snntp) IESG RFC 4642

Registry dates for this port: last modified 2018-07-06.

Check what is listening on port 563

Linux: is anything listening on TCP 563?
sudo ss -tlnp 'sport = :563'
Linux / macOS: which process owns the port
sudo lsof -nP -i :563
Older Linux / BSD (net-tools)
sudo netstat -tlnp | grep ':563 '
Windows (Command Prompt)
netstat -ano | findstr :563
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 563 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine
nc -vz -w 5 HOST 563
From Windows
Test-NetConnection HOST -Port 563

Allow only trusted sources on port 563 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)
sudo ufw allow from 203.0.113.10 to any port 563 proto tcp
iptables
sudo iptables -A INPUT -p tcp --dport 563 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 563 -j DROP
nftables
sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 563 accept
sudo nft add rule inet filter input tcp dport 563 drop
Windows Firewall
New-NetFirewallRule -DisplayName 'TCP 563 trusted' -Direction Inbound -Protocol TCP -LocalPort 563 -RemoteAddress 203.0.113.10 -Action Allow

Related ports

119NNTP560rmonitor562chshell5649pfs565whoami

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.