53
Summary
- // if you see it open
- Misconfigured AXFR zone transfers can leak an organization's entire internal DNS namespace; DNS tunneling over TCP enables covert exfiltration/C2; resolver cache poisoning. An internet-facing 53/tcp typically indicates an authoritative or recursive name server.
- // common applications
- BINDUnboundKnot DNSPowerDNSdnsmasqCoreDNS
- // analyst note
- Open 53/tcp indicates a DNS server. Attempt an AXFR to detect unrestricted zone transfer, check for open recursion, and inspect for tunneling signatures.
About port 53/tcp.
Port 53/tcp carries the Domain Name System over its reliable transport. While most DNS lookups use UDP, TCP/53 handles the cases UDP cannot: zone transfers (AXFR/IXFR between authoritative servers) and any response that exceeds the UDP payload size — large answer sets, DNSSEC-signed records, and EDNS fallback triggered by the truncation (TC) bit. DNS itself is the distributed, hierarchical naming database that resolves human-readable names into IP addresses and other resource records. The IANA service name registered here is domain, attributed in the registry to Paul Mockapetris, the protocol's author — but the registry cites no RFC for the assignment, so the governing specifications are RFC 1034 (concepts) and RFC 1035 (implementation), both from November 1987. For an analyst, an internet-facing 53/tcp signals a DNS server, either authoritative or recursive. The highest-value triage steps are attempting an AXFR to detect an unrestricted zone transfer (which can leak an organization's entire internal namespace to anyone who asks), determining whether the server is an open recursive resolver, and inspecting query patterns for DNS tunneling — a covert data-exfiltration and command-and-control channel that rides inside ordinary-looking DNS traffic.
- IANA assignment
domain— "Domain Name Server"; reference (blank — no RFC cited in IANA registry); governing protocol RFC 1034/1035 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.048463 [Well-established] — nmap-services file
- Related ports
- 53/udp (primary DNS transport); 853 DNS-over-TLS; 443 DNS-over-HTTPS/QUIC; 5353 mDNS
Primary use
DNS zone transfers (AXFR/IXFR) and responses too large for UDP (large/DNSSEC answers, EDNS fallback via TC bit)
Other/unofficial uses
DNS-tunneling tools (iodine, dnscat2) and covert C2
Security implications
misconfigured AXFR can leak the full internal namespace; DNS tunneling for exfiltration/C2; resolver cache poisoning. An exposed 53/tcp typically indicates an authoritative or recursive name server
Typically seen on
authoritative DNS servers, recursive resolvers, Active Directory domain controllers, routers/home gateways
- Analyst note
- Open 53/tcp indicates a DNS server. Attempt an AXFR to detect unrestricted zone transfer, check for open recursion, and inspect for tunneling signatures.
About port 53/udp.
Port 53/udp is the standard transport for Domain Name System queries and responses — the channel often called "Do53" — and the overwhelming majority of DNS lookups on the internet travel over it. Its appeal is low overhead: connectionless single-datagram exchanges with no handshake, historically capped at 512 bytes (EDNS0 extends this), falling back to TCP only when a response is truncated. The IANA service name is domain, attributed in the registry to Paul Mockapetris, but the registry cites no RFC; the protocol is defined in RFC 1034 and RFC 1035 (1987), with source-port randomization (RFC 5452) and DNSSEC (RFC 4033–4035) added later. UDP is also exactly what makes port 53 a security liability: because source addresses are trivially spoofed, open recursive resolvers are a favorite reflection/amplification vector for DDoS, answering spoofed-source queries with far larger replies. The 2008 Kaminsky cache-poisoning attack exploited weak query randomization on this transport. For an analyst, an open 53/udp is the canonical DNS service — the priorities are confirming it is not an abusable open recursive resolver, assessing amplification exposure, and watching for anomalous query volume or tunneling signatures. Plaintext Do53 also leaks browsing metadata, which is what DoT, DoH, and DoQ were designed to address.
- IANA assignment
domain— "Domain Name Server"; reference (blank — no RFC cited in IANA registry); governing protocol RFC 1034/1035 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.213496 (one of the most common open UDP ports; top ~10 in published UDP rankings) [Well-established] — nmap-services file
- Related ports
- 53/tcp; 853 DoT; 443 DoH/DoQ; 5353 mDNS
Primary use
the standard DNS query/response transport ("Do53"); the default for the vast majority of DNS lookups
Other/unofficial uses
tunneling/covert channels; occasional app/game port abuse
Security implications
DNS amplification/reflection DDoS via open resolvers (UDP source spoofing); cache poisoning (Kaminsky 2008, mitigated by RFC 5452 source-port randomization); DNS tunneling; plaintext metadata leakage
Typically seen on
recursive resolvers, routers/home gateways, IoT devices (heavy plaintext Do53), domain controllers
- Analyst note
- Open 53/udp is the canonical DNS service. Confirm it is not an abusable open recursive resolver, assess amplification exposure, and monitor for anomalous query volume or tunneling.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| domain | UDP | Domain Name Server | 21.35% |
| domain | TCP | Domain Name Server | 4.85% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.