Port reference
Port 563 (TCP) – NNTPS
Network News Transfer Protocol wrapped in TLS for encrypted Usenet access and feeds.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Offered by Usenet/news servers that support TLS. Not enabled by default on general-purpose systems.
What is port 563 used for?
Port 563 carries NNTPS — Usenet news (the NNTP protocol) wrapped in TLS so the connection is encrypted. It is the secure version of plaintext NNTP on port 119, and it is what you use to read and post articles or pull news feeds over an encrypted link. Usenet providers (such as Newshosting, Eweka, or Giganews) offer it, and newsreaders like SABnzbd, NZBGet, Thunderbird, and Pan can connect to it.
When would you open it?
You only need to open port 563 if you run your own Usenet/news server and want clients to reach it over TLS. Most people are clients, not servers, so they simply connect outbound to a provider on 563 and never open anything on their own router.
Is it safe to open?
It is reasonable to expose if you require TLS and authentication and keep the news server patched; the main risk is exposing an unpatched daemon or weak TLS. Keep it private or behind a VPN if it is for personal use. See the security notes below.
How to check if this port is open
ss -tulpn | grep :563
nmap -p 563 <target>netstat -ano | findstr :563
Test-NetConnection <host> -Port 563lsof -i :563
nmap -p 563 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 563 to your device's local IP, internal port 563, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 563/tcpsudo firewall-cmd --permanent --add-port=563/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 563 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 563" -Direction Inbound -Protocol TCP -LocalPort 563 -Action AllowSecurity & risks
Common attacks
- Credential capture if TLS is downgraded or stripped
- Exploitation of weak TLS versions and cipher suites
- Brute force of newsreader authentication
- Server-side vulnerabilities in the NNTP daemon
Hardening
- Require TLS 1.2+ and disable legacy SSL/TLS versions and weak ciphers
- Use valid, current certificates and verify them on clients
- Enforce authentication and rate-limit login attempts
- Keep the news server software patched
How to block this port
sudo ufw deny 563/tcpsudo firewall-cmd --permanent --remove-port=563/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 563 -j DROPNew-NetFirewallRule -DisplayName "Block 563" -Direction Inbound -Protocol TCP -LocalPort 563 -Action Blocknmap snippet
nmap -p563 --script ssl-cert,ssl-enum-ciphers <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 119 and 563?
- Port 119 carries plaintext NNTP (Usenet news), while port 563 carries the same protocol wrapped in TLS (NNTPS). Use 563 so credentials and article traffic are encrypted in transit.
- Is port 563 still used?
- Yes, by Usenet providers and newsreaders that support encrypted access. Where TLS is available, 563 should be preferred over the cleartext NNTP port 119.