Port reference
Port 53 (TCP/UDP) – DNS
Domain Name System — resolves hostnames to IP addresses and serves zone data.
Quick facts
- Transport
- tcp, udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on every recursive resolver and authoritative nameserver. Often unintentionally exposed as an open resolver on the internet.
What is port 53 used for?
Port 53 carries the Domain Name System (DNS), the service that turns hostnames like example.com into IP addresses. It is used by recursive resolvers and authoritative nameservers alike — software such as BIND, Unbound, dnsmasq, and the popular ad-blocking resolver Pi-hole. Most lookups use UDP 53, with TCP 53 handling larger responses and zone transfers.
When would you open it?
You open port 53 when you run your own DNS server — for example a home Pi-hole or AdGuard Home that filters ads for your network, an Unbound resolver for privacy, or an authoritative nameserver hosting your domain. Only open or forward it if you actually run a DNS service and need other machines to reach it.
Is it safe to open?
The main risk is becoming an open resolver abused for amplification attacks, so keep recursion limited to trusted clients and avoid exposing it to the whole internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :53
nmap -p 53 <target>netstat -ano | findstr :53
Test-NetConnection <host> -Port 53lsof -i :53
nmap -p 53 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 53 to your device's local IP, internal port 53, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 53/tcpsudo firewall-cmd --permanent --add-port=53/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 53 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 53" -Direction Inbound -Protocol TCP -LocalPort 53 -Action AllowSecurity & risks
Common attacks
- DNS amplification / reflection DDoS via open resolvers
- Unauthorized zone transfer (AXFR) leaking internal records
- Cache poisoning and spoofing of recursive answers
- DNS tunneling for covert exfiltration and C2
Hardening
- Disable open recursion — answer recursive queries only for trusted clients
- Restrict zone transfers (AXFR) to authorized secondaries by IP and TSIG
- Enable DNSSEC validation to defeat cache poisoning
- Rate-limit responses (RRL) to blunt amplification abuse
- Keep BIND/Unbound/Knot patched; separate authoritative and recursive roles
How to block this port
sudo ufw deny 53/tcpsudo firewall-cmd --permanent --remove-port=53/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 53 -j DROPNew-NetFirewallRule -DisplayName "Block 53" -Direction Inbound -Protocol TCP -LocalPort 53 -Action Blocknmap snippet
nmap -sU -p53 --script dns-recursion,dns-zone-transfer,dns-cache-snoop <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does DNS use TCP or UDP?
- Both. DNS uses UDP 53 for most queries and falls back to TCP 53 for responses larger than the UDP limit and for zone transfers (AXFR).
- Why is an open DNS resolver dangerous?
- Open resolvers answer recursive queries from anyone, letting attackers spoof a victim's IP and use the small-query/large-response gap for amplification DDoS.