Port reference
Port 853 (TCP) – DNS over TLS (DoT)
DNS over TLS — wraps DNS queries in a TLS tunnel so resolution cannot be read or tampered with in transit.
Quick facts
- Transport
- tcp
- Category
- Well-known
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on resolvers that offer encrypted DNS. Distinct, easily blocked port, unlike DoH which hides inside HTTPS on 443.
What is port 853 used for?
Port 853 carries DNS over TLS (DoT), which encrypts your DNS lookups so nobody on the network can see or tamper with the websites you resolve. Public resolvers like Cloudflare's 1.1.1.1, Google, and Quad9 offer it, and clients such as Android's Private DNS, systemd-resolved, and Stubby connect over this port. Home setups running Pi-hole with Unbound also use it to fetch results securely.
When would you open it?
You only open port 853 if you run your own DNS resolver and want devices to reach it over encrypted DNS. A typical case is forwarding it to a self-hosted Pi-hole or Unbound server so your network resolves names privately. Most people never need to open it, since they just point clients at a public resolver.
Is it safe to open?
The main risk is exposing a resolver that could be abused or spoofed, so use valid TLS certificates, keep the service private or behind a VPN, and restrict who can query it. See the security notes below.
How to check if this port is open
ss -tulpn | grep :853
nmap -p 853 <target>netstat -ano | findstr :853
Test-NetConnection <host> -Port 853lsof -i :853
nmap -p 853 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 853 to your device's local IP, internal port 853, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 853/tcpsudo firewall-cmd --permanent --add-port=853/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 853 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 853" -Direction Inbound -Protocol TCP -LocalPort 853 -Action AllowSecurity & risks
Common attacks
- Downgrade to plaintext DNS on port 53 when DoT is blocked
- Port-853 blocking for censorship or to force cleartext resolution
- Certificate spoofing / MITM against clients that skip validation
- Malware abusing DoT to hide DNS-based C2 from inspection
Hardening
- Pin or strictly validate the resolver's certificate and SPKI
- Use Strict mode so failures do not silently fall back to port 53
- Block outbound plaintext DNS to force encrypted resolution
- Choose trusted resolvers and keep the DoT server (e.g. Unbound) patched
- Log and monitor DoT endpoints for anomalous query volume
How to block this port
sudo ufw deny 853/tcpsudo firewall-cmd --permanent --remove-port=853/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 853 -j DROPNew-NetFirewallRule -DisplayName "Block 853" -Direction Inbound -Protocol TCP -LocalPort 853 -Action Blocknmap snippet
nmap -p853 --script ssl-cert,ssl-enum-ciphers <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 853 (DoT) and port 443 (DoH)?
- DoT on 853 is a dedicated TLS port carrying only DNS, so it is easy to identify and block. DoH on 443 hides DNS inside ordinary HTTPS traffic, making it harder to distinguish.
- Does DNS over TLS make me anonymous?
- No. DoT encrypts queries from eavesdroppers on the path, but the resolver itself still sees every domain you look up. It is privacy from the network, not anonymity.