What it's for
Port 53 is the port DNS (Domain Name System) runs on — the service that translates human-readable domain names like cooldev.tools into IP addresses. Every time a device resolves a hostname, whether it's a browser loading a page or your server calling an external API, a DNS query goes out on port 53.
It's one of the few ports that runs on both UDP and TCP by design: most everyday lookups are quick UDP exchanges, while TCP is used for larger responses and specific operations like zone transfers between DNS servers.
Protocol basics
- Protocol: UDP for the vast majority of queries — fast, connectionless, and sufficient since most DNS responses fit in a single small packet.
- TCP fallback for large responses. When a DNS response exceeds what fits in a single UDP packet (large record sets, DNSSEC-signed responses), the resolver retries over TCP on the same port 53.
- TCP is mandatory for zone transfers. When a secondary DNS server syncs an entire zone file from a primary, that AXFR/IXFR transfer always uses TCP, since it needs reliable delivery of a potentially large dataset.
- Recursive vs. authoritative resolution. A recursive resolver (like your ISP's DNS server or 8.8.8.8) queries multiple authoritative servers on your behalf, potentially hopping through root servers, TLD servers, and the domain's own authoritative nameservers — all typically over port 53.
Security considerations
- DNS amplification attacks exploit UDP's connectionless nature — an attacker spoofs the victim's IP as the query source, and open DNS resolvers send disproportionately large responses to that spoofed address, overwhelming it. This is why open, unrestricted DNS resolvers are a real liability if exposed publicly.
- DNSSEC adds cryptographic signatures to DNS records so resolvers can verify responses haven't been tampered with — it doesn't encrypt queries, but it does prevent response forgery/cache poisoning.
- DNS itself is unencrypted by default — plain port 53 queries reveal every domain you're resolving to anyone observing the network. DNS-over-HTTPS (DoH, port 443) and DNS-over-TLS (DoT, port 853) exist specifically to address this privacy gap.
- Restrict recursive resolvers to trusted networks. A DNS server that will recursively resolve queries for anyone on the internet (not just its own trusted clients) is both an amplification-attack risk and a misconfiguration red flag.
Troubleshooting
"Server not found" / DNS resolution failures:
- Check whether the issue is your local resolver (try
nslookup domain 8.8.8.8to bypass your default DNS and test against Google's public resolver) - Firewall blocking outbound UDP/TCP 53 to your configured DNS servers
Intermittent DNS failures, works sometimes:
- Could be a flaky/overloaded DNS server, or UDP packet loss on the network — since UDP has no automatic retry at the protocol level for basic queries, some resolvers handle this better than others
DNS changes not taking effect:
- Almost always a caching/TTL issue rather than a port 53 problem — DNS records are cached at multiple layers (OS, browser, ISP resolver) according to their TTL, and changes won't be visible everywhere until those caches expire
Zone transfer fails between DNS servers:
- Confirm TCP (not just UDP) port 53 is open between the servers, since zone transfers specifically require TCP
Comparison / FAQ
| Port | Protocol | Key difference from 53 (DNS) |
|---|---|---|
| 443 (DoH) | TCP | DNS queries tunneled inside encrypted HTTPS, hiding lookups from network observers |
| 67/68 (DHCP) | UDP | Different service entirely (IP address assignment), but often configured alongside DNS in the same network setup |
Why does DNS use both UDP and TCP on the same port?
UDP handles the common case efficiently since most responses are small and speed matters more than guaranteed delivery for a single lookup. TCP is used as a fallback for responses too large for one UDP packet, and is required for zone transfers between DNS servers.
What's the difference between DNS on port 53 and DNS-over-HTTPS?
Both resolve domain names, but traditional port 53 DNS is unencrypted, meaning your queries are visible to anyone on the network path. DNS-over-HTTPS wraps the same queries inside encrypted HTTPS traffic on port 443, hiding what domains you're looking up from network-level observation.
Why are open DNS resolvers considered a security risk?
Because they can be abused in DNS amplification attacks — an attacker spoofs a victim's IP as the source of a query, and the open resolver sends a disproportionately large response to that spoofed address, contributing to a denial-of-service attack against the victim.
Does DNSSEC encrypt my DNS queries?
No — DNSSEC adds cryptographic signatures so a resolver can verify a response hasn't been tampered with, but the queries and responses themselves remain visible in plaintext. Encryption is a separate concern handled by DoH or DoT.