{
  "port": 53,
  "protocol": "both",
  "service": "DNS",
  "oneLiner": "DNS — name resolution, on UDP for ordinary queries and TCP for large answers and zone transfers.",
  "whatItIs": "Two very different roles share this port: authoritative servers (BIND, NSD, PowerDNS, cloud DNS) that answer for zones they own, and recursive resolvers (Unbound, dnsmasq, systemd-resolved, 1.1.1.1) that answer for clients. UDP is used first; a truncated response sets the TC bit and the client retries over TCP, which also carries AXFR zone transfers. On a laptop you will find something bound to 127.0.0.53 or 127.0.0.1:53 as the local stub resolver. Encrypted variants live elsewhere: DoT on 853, DoH on 443.",
  "exposure": {
    "verdict": "careful",
    "note": "Public authoritative service on 53 is normal; an open recursive resolver is not, because it gets used as a DDoS amplifier."
  },
  "checkCommand": "dig @1.1.1.1 example.com A +noall +answer",
  "links": [
    {
      "title": "RFC 1035 — Domain Names: Implementation and Specification",
      "url": "https://www.rfc-editor.org/rfc/rfc1035.html",
      "kind": "spec"
    },
    {
      "title": "Unbound (validating recursive resolver) source repository",
      "url": "https://github.com/NLnetLabs/unbound",
      "kind": "github"
    },
    {
      "title": "ISC BIND 9",
      "url": "https://www.isc.org/bind/",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}