Port 853 (DNS over TLS / DNS over QUIC)

Encrypted DNS: DNS over TLS on TCP 853 (Android Private DNS, systemd-resolved) and DNS over QUIC on UDP 853.

Well-known (system) port, 0-1023 TCPUDP Network infrastructure Meant to face the internet

What port 853 is used for

Encrypted DNS: DNS over TLS on TCP 853 (Android Private DNS, systemd-resolved) and DNS over QUIC on UDP 853.

Security: should port 853 be open?

Meant to face the internet. Public resolvers expose it by design. Networks that need to enforce their own DNS block outbound 853, which forces clients back to port 53 (DNS over HTTPS on 443 cannot be separated this way).

IANA assignment

Service nameProtoDescriptionAssigneeReference

domain-s TCP DNS query-response protocol run over TLS IESG RFC 7858

domain-s UDP DNS query-response protocol run over DTLS or QUIC IESG RFC 7858, RFC 8094, RFC 9250

Registry dates for this port: registered 2015-10-08, last modified 2022-04-11.

Check what is listening on port 853

Linux: is anything listening on TCP 853?

sudo ss -tlnp 'sport = :853'

Linux: UDP 853

sudo ss -ulnp 'sport = :853'

Linux / macOS: which process owns the port

sudo lsof -nP -i :853

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':853 '

Windows (Command Prompt)

netstat -ano | findstr :853

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 853 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 853

From Windows

Test-NetConnection HOST -Port 853

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 853

Open port 853 in the firewall

ufw

sudo ufw allow 853/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 853 -j ACCEPT

nftables

sudo nft add rule inet filter input tcp dport 853 accept

Windows Firewall

New-NetFirewallRule -DisplayName 'Allow TCP 853' -Direction Inbound -Protocol TCP -LocalPort 853 -Action Allow

ufw

sudo ufw allow 853/udp