DNS — name resolution, on UDP for ordinary queries and TCP for large answers and zone transfers.
Two very different roles share this port: authoritative servers (BIND, NSD, PowerDNS, cloud DNS) that answer for zones they own, and recursive resolvers (Unbound, dnsmasq, systemd-resolved, 1.1.1.1) that answer for clients. UDP is used first; a truncated response sets the TC bit and the client retries over TCP, which also carries AXFR zone transfers. On a laptop you will find something bound to 127.0.0.53 or 127.0.0.1:53 as the local stub resolver. Encrypted variants live elsewhere: DoT on 853, DoH on 443.
Expose with care
Public authoritative service on 53 is normal; an open recursive resolver is not, because it gets used as a DDoS amplifier.
$ dig @1.1.1.1 example.com A +noall +answerSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.