563

Port 563/tcp is registered with IANA as nntps with the description "nntp protocol over TLS/SSL (was snntp)," assignee IESG (IETF Chair contact), a reference of [RFC4642], and a modification date of 2018-07-06 (dual-registered on TCP and UDP; nmap labels 563/tcp as snews). It provides secure, TLS-wrapped access to Usenet/NNTP news servers for reading and posting articles privately. Port 563 is the implicit-TLS port for NNTP: the client opens TLS immediately on connect and then speaks NNTP inside the tunnel, analogous to HTTPS. RFC 4642 (October 2006) standardized TLS for NNTP — it primarily defines the STARTTLS command on port 119 (the preferred mechanism in 4642) but documents that port 563 had already been dedicated to implicit "NNTP over TLS" — and RFC 8143 (April 2017) updates 4642 to explicitly affirm that TCP port 563 is dedicated to NNTP over TLS and registered as such, treating implicit TLS as the preferred approach under modern best practice. It pairs with 119 (nntp) and 433 (nnsp, transit). The IANA reference field is [RFC4642]. Security-wise it is a clear improvement over plaintext NNTP on 119, providing confidentiality and integrity for credentials and article data, with minimal protocol-specific threat; many commercial Usenet providers still offer 563 for encrypted access. For an analyst, an open 563/tcp indicates a Usenet/news server offering encrypted (implicit-TLS) reader access — benign and used by commercial Usenet providers.

IANA assignment

nntps — "nntp protocol over TLS/SSL (was snntp)"; reference [RFC4642]; assignee IESG (IETF Chair contact); modification date 2018-07-06; dual-registered 563/tcp + 563/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.000916 (de-facto) [Well-established] — nmap-services file

Related ports

119 (nntp), 433 (nnsp/NNTP transit)

Primary use

secure (implicit-TLS) access to Usenet/NNTP news servers

Other/unofficial uses

none meaningful [Well-established]

Security implications

improvement over plaintext NNTP/119 (confidentiality + integrity); minimal protocol-specific threat; many commercial Usenet providers still use 563 [Well-established]

Typically seen on

Usenet/news servers (commercial providers)

Analyst note

An open 563/tcp indicates a Usenet/news server offering encrypted (implicit-TLS) reader access; benign, used by commercial Usenet providers.