# WHATPORT(53)

## NAME

port 53 — DNS — DNS — name resolution, on UDP for ordinary queries and TCP for large answers and zone transfers.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

Two very different roles share this port: authoritative servers (BIND, NSD, PowerDNS, cloud DNS) that answer for zones they own, and recursive resolvers (Unbound, dnsmasq, systemd-resolved, 1.1.1.1) that answer for clients. UDP is used first; a truncated response sets the TC bit and the client retries over TCP, which also carries AXFR zone transfers. On a laptop you will find something bound to 127.0.0.53 or 127.0.0.1:53 as the local stub resolver. Encrypted variants live elsewhere: DoT on 853, DoH on 443.

## EXPOSURE

**Expose with care.** Public authoritative service on 53 is normal; an open recursive resolver is not, because it gets used as a DDoS amplifier.

## CHECK

```sh
dig @1.1.1.1 example.com A +noall +answer
```

## SEE ALSO

- spec — [RFC 1035 — Domain Names: Implementation and Specification](https://www.rfc-editor.org/rfc/rfc1035.html) (rfc-editor.org)
- source — [Unbound (validating recursive resolver) source repository](https://github.com/NLnetLabs/unbound) (github.com)
- docs — [ISC BIND 9](https://www.isc.org/bind/) (isc.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/53/> · JSON: <https://whatport.net/53.json> · full dataset: <https://whatport.net/ports.json>