Port 53: DNS (Domain Name System)

What is port 53 used for?

Port 53 is DNS. Clients send queries to it to turn names such as example.com into IP addresses, and DNS servers use it to talk to each other.

A firewall rule that allows only UDP 53 is a common mistake: large answers, such as those carrying DNSSEC signatures, and zone transfers then fail in ways that are hard to spot. Since almost every network lets port 53 out, attackers also abuse it, hiding data in queries (DNS tunnelling) or pointing clients at a rogue resolver. Classic DNS on 53 is unencrypted, so anyone on the path can see which names are looked up.

What DNS stands for, with an example

Is port 53 TCP or UDP?

Both. Ordinary queries use UDP 53 because it is fast. DNS switches to TCP 53 when a response is too large for UDP and for zone transfers between servers, and RFC 7766 requires general-purpose DNS implementations to support both.

Is DNS on port 53 encrypted?

No. Queries and answers on port 53 are clear text. DNS over TLS encrypts them on port 853, and DNS over HTTPS carries them inside HTTPS on port 443. DNSSEC is different: it signs the answers so they cannot be forged, but does not hide them.

Port 53 vs port 853: what is the difference?

Port 53 is classic, unencrypted DNS over UDP and TCP. Port 853 is DNS over TLS: the same queries inside an encrypted connection between the client and its resolver.

Which CompTIA exams list port 53?

CompTIA lists port 53 by number in both the Network+ and the A+ Core 1 objectives.

• Network+ N10-009: objective 1.4 (Networking Concepts), listed as “Domain Name System (DNS), 53”.
• A+ Core 1 220-1201: objective 2.1 (Networking), listed as “53, Domain Name System (DNS)”.

The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.

Check yourself: a practice question

Written by CertSprint for this page. It is not taken from any exam.