What is an open DNS resolver risk?

If an internal DNS server responds to queries from arbitrary public internet IPs on port 53, attackers can send forged requests that generate amplified replies targeting a victim, turning the server into a DDoS weapon.

How do DoH and DoT relate to port 53?

Traditional DNS uses cleartext Port 53. Modern encrypted standards bypass port 53: DNS-over-HTTPS (DoH) uses standard HTTPS port 443, and DNS-over-TLS (DoT) uses dedicated port 853.

How can I verify port 53 connectivity?

Test TCP reachability using our Open Port Checker tool, or test UDP DNS responses using 'dig @ example.com'.

Home/Open Port Checker/Port 53

Port 25 Port 80

Well-Known Port Reference

Port 53: DNS (Domain Name System) (TCP/UDP)

Domain Name System resolution port translating human-readable domain names into machine-routable IP addresses.

Port Number

Transport

TCP/UDP

Security Risk

Medium

Standard / RFC

RFC 1035

Test Port 53 Reachability Live

Verify whether Port 53 is open, closed, or filtered on your server or public IP address.

Loading port checker...

Service Architecture & Function

Port 53 serves as the backbone of Internet routing. Standard DNS queries and answers operate over UDP port 53 for low latency and minimal overhead. When responses exceed 512 bytes (common with DNSSEC records or large TXT records) or during authoritative DNS zone transfers (AXFR), the communication falls back to TCP port 53.

Security Profile & Hardening

Open recursive DNS resolvers listening on UDP port 53 are frequently abused in DNS amplification DDoS attacks due to IP spoofing. Authoritative DNS servers must disable open recursion, implement response rate limiting (RRL), and enforce DNSSEC.

Example Firewall Commands:

# UFW (Ubuntu/Debian)

sudo ufw allow 53

# iptables (Direct Kernel)

iptables -A INPUT -p udp --dport 53 -j ACCEPT && iptables -A INPUT -p tcp --dport 53 -j ACCEPT

Frequently Asked Questions

Technical answers and configuration advice for Port 53.

DNS runs on both. Routine lookups use UDP port 53 for speed, while responses exceeding 512 bytes (such as DNSSEC keys) and full zone transfers (AXFR) rely on TCP port 53.