563

Port 563/tcp is registered with IANA as nntps with the description "nntp protocol over TLS/SSL (was snntp)," assignee IESG (IETF Chair contact), a reference of [RFC4642], and a modification date of 2018-07-06 (dual-registered on TCP and UDP; nmap labels 563/tcp as snews). It provides secure, TLS-wrapped access to Usenet/NNTP news servers for reading and posting articles privately. Port 563 is the implicit-TLS port for NNTP: the client opens TLS immediately on connect and then speaks NNTP inside the tunnel, analogous to HTTPS. RFC 4642 (October 2006) standardized TLS for NNTP — it primarily defines the STARTTLS command on port 119 (the preferred mechanism in 4642) but documents that port 563 had already been dedicated to implicit "NNTP over TLS" — and RFC 8143 (April 2017) updates 4642 to explicitly affirm that TCP port 563 is dedicated to NNTP over TLS and registered as such, treating implicit TLS as the preferred approach under modern best practice. It pairs with 119 (nntp) and 433 (nnsp, transit). The IANA reference field is [RFC4642]. Security-wise it is a clear improvement over plaintext NNTP on 119, providing confidentiality and integrity for credentials and article data, with minimal protocol-specific threat; many commercial Usenet providers still offer 563 for encrypted access. For an analyst, an open 563/tcp indicates a Usenet/news server offering encrypted (implicit-TLS) reader access — benign and used by commercial Usenet providers.

IANA assignment

nntps — "nntp protocol over TLS/SSL (was snntp)"; reference [RFC4642]; assignee IESG (IETF Chair contact); modification date 2018-07-06; dual-registered 563/tcp + 563/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000916 (de-facto) [Well-established] — nmap-services file

Related ports

119 (nntp), 433 (nnsp/NNTP transit)

Primary use

secure (implicit-TLS) access to Usenet/NNTP news servers

Other/unofficial uses

none meaningful [Well-established]

Security implications

improvement over plaintext NNTP/119 (confidentiality + integrity); minimal protocol-specific threat; many commercial Usenet providers still use 563 [Well-established]

Typically seen on

Usenet/news servers (commercial providers)

Analyst note

An open 563/tcp indicates a Usenet/news server offering encrypted (implicit-TLS) reader access; benign, used by commercial Usenet providers.

Port 563/udp carries IANA's dual registration for nntps — NNTP (Network News Transfer Protocol) over TLS/SSL — but no source documents actual UDP traffic for this service, so it should not be expected as an active internet-facing listener and any traffic observed there is unusual enough to warrant a second look rather than treated as routine NNTPS activity.

IANA registers 563 on both tcp and udp with the service name nntps, description "nntp protocol over TLS/SSL (was snntp)," reference RFC 4642, and assignee [IESG]; the registry entry was last modified 2018-07-06. NNTP itself is a connection-oriented, stream-based protocol built on TCP, and RFC 4642 defines NNTPS purely as a TLS wrapper around the TCP-based NNTP session — the udp registration functions as a paired/reserved entry rather than a port with its own documented traffic.

nmap-services records an open-frequency of roughly 0.0675% for 563/udp, compared to roughly 0.0916% for 563/tcp — both low, consistent with a niche service whose real-world deployment sits almost entirely on the TCP side. Software documented using NNTPS is TCP-side only: news server daemons such as INN and Leafnode with SSL/TLS listeners, and newsreader clients such as Thunderbird, Pan, and KNode connecting to a news server's secure port. No community-sourced report of an application generating 563/udp traffic specifically was found.

SANS Internet Storm Center's port-563 tracker shows only routine low-to-moderate background scan volume, with the site's overall threat indicator at green (no elevated activity), and no CVE or malware family is recorded against the port as of a September 2026 search. Given the protocol is inherently TCP-based, the most defensible reading of 563/udp is that it exists on paper as a registry formality rather than as a service any host should be running.

Exposure

563/udp has no documented legitimate traffic of its own; NNTPS operates over TCP, so a host answering on 563/udp is not delivering the registered service and should be treated as unexpected rather than routine.

Scanning activity

SANS ISC's port-563 tracker shows only low-to-moderate daily background scan volume, with the site's overall threat indicator at green (no elevated activity), consistent with routine internet noise rather than targeted probing.

CVE / malware

No CVE or malware family is recorded against 563/udp in the sources checked as of a September 2026 search.

If seen open

Investigate rather than assume routine NNTPS service — confirm whether the host is actually running a UDP listener or whether the response reflects a firewall/NAT artifact, scan noise, or misconfiguration, since no legitimate application is documented to generate this traffic.

IANA assignment

nntps — "nntp protocol over TLS/SSL (was snntp)"; reference RFC 4642; assignee [IESG]; dual-registered 563/tcp + 563/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nntps 563/udp

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency 563/udp ≈ 0.000675 (~0.0675%); 563/tcp ≈ 0.000916 (~0.0916%) [Confirmed] — this site's own tooling (built from nmap-services)

Related ports

119/tcp (plaintext NNTP); 563/tcp (the paired NNTPS registration on which the documented service actually runs) [Confirmed]

Primary use

TCP-based NNTP-over-TLS registration per RFC 4642; the udp side is a paired/reserved registry entry with no documented independent UDP traffic

Other/unofficial uses

none documented specifically for 563/udp as of a September 2026 search [Unknown]

Security implications

SANS ISC records only routine low/moderate scan volume, with the site's overall threat indicator at green (no elevated activity); no CVE or malware documented against the port as of a September 2026 search

Typically seen on

no UDP-specific software documented; TCP-side NNTPS servers (INN, Leafnode) and clients (Thunderbird, Pan, KNode) are the documented software for the nntps service generally

Registry last modified

2018-07-06 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry nntps 563/udp