853
Summary
- // if you see it open
- Prevents on-path DNS surveillance and tampering on the stub-to-resolver hop. RFC 7858 forbids cleartext fallback on 853. RFC 8310 defines strict vs opportunistic privacy profiles. Because the port is dedicated and identifiable, networks that require DNS visibility often block it, and DoT/DoH can bypass internal DNS security controls (filtering, logging, RPZ). RFC 7830 padding resists size-based traffic analysis.
- // common applications
- UnboundKnot Resolverstubbysystemd-resolved
- // analyst note
- Open 853/tcp usually marks an encrypted-DNS resolver; on an unexpected host consider encrypted-DNS tunneling/C2. Check the TLS certificate and whether it is a known resolver.
About port 853/tcp.
Port 853/tcp is the dedicated home of DNS over TLS, standardized in RFC 7858 (May 2016), which wraps ordinary DNS wire-format messages inside a TLS-encrypted TCP session. The DNS message itself is unchanged — only a TLS layer is added — and the point is to close the DNS "last-mile" privacy gap: classic Do53 on port 53 sends queries in cleartext, exposing them to on-path eavesdropping and tampering. RFC 7858 is strict about the port: 853 must carry only encrypted traffic, and implementations must not fall back to cleartext on it. A single TLS session pipelines multiple queries to amortize the handshake cost. RFC 8310 adds authentication and usage profiles — strict privacy (the client configures an authentication domain name and requires a validated TLS connection, treating failure as fatal) versus opportunistic privacy (try TLS, fall back to cleartext if it fails, which only defends against passive observers). DoT differs from DoH (DNS over HTTPS, RFC 8484, port 443) mainly in port and framing: DoT's dedicated, identifiable port is easy to recognize and to block, whereas DoH blends into HTTPS on 443. The privacy benefit is real, but a dedicated port means networks that require DNS visibility frequently block 853 outright, and DoT/DoH can bypass enterprise DNS-based security controls (filtering, logging, RPZ) when endpoints reach external resolvers directly. RFC 7830 defines EDNS(0) padding to blunt size-based traffic analysis. For an analyst, an open 853/tcp usually marks an encrypted-DNS resolver; on an unexpected host it can indicate encrypted-DNS tunneling, so check the TLS certificate and whether it is a known public resolver.
- IANA assignment
domain-s— "DNS query-response protocol run over TLS"; reference [RFC7858]; assignee IESG/IETF Chair; registered 2015-10-08, modified 2022-04-11 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.000025 — very rare in internet-wide TCP scans [Well-established] — nmap-services file
- Related ports
- 53 (cleartext Do53); 443 (DoH); 853/udp (DoQ / DNS-over-DTLS)
Primary use
encrypted DNS (DNS-over-TLS) between stub/forwarder and recursive resolver
Other/unofficial uses
encrypted-DNS tunneling / C2 (threat-reported, see malware)
Security implications
prevents on-path DNS surveillance/tampering on the stub→resolver hop; dedicated port is easily blocked (enterprise control, censorship context); can bypass internal DNS security controls; RFC 7830 padding resists traffic analysis
Typically seen on
public recursive resolvers (Cloudflare 1.1.1.1, Google Public DNS, Quad9), enterprise/ISP resolvers, Android "Private DNS" clients
- Analyst note
- Open 853/tcp usually marks an encrypted-DNS resolver; on an unexpected host consider encrypted-DNS tunneling/C2. Check the TLS certificate and whether it is a known resolver.
About port 853/udp.
Port 853/udp carries the UDP-based encrypted-DNS transports, and a single IANA entry (domain-s) covers two of them. DNS over DTLS (RFC 8094, February 2017, Experimental) runs DNS inside Datagram TLS over UDP 853, reusing the port already allocated for DoT; it stayed experimental and saw little deployment. DNS over QUIC (DoQ, RFC 9250, May 2022) is the one that matters in practice: it carries DNS directly over QUIC — which embeds TLS 1.3 — on UDP 853, mapping each query/response to its own QUIC bidirectional stream and requiring the DNS Message ID be set to zero. DoQ provides confidentiality and integrity comparable to DoT, but with QUIC's advantages: 0-RTT resumption, no head-of-line blocking, connection migration across network changes, and latency closer to classic UDP DNS. Its ALPN token is doq, and because QUIC v1 was designed to coexist with DTLS on a shared port, a server can offer both DoDTLS and DoQ on 853. DoQ originally experimented on port 784 before the working group settled on reusing 853. The privacy posture matches DoT, with two QUIC-specific cautions: 0-RTT early data must not carry replayable operations, and padding is still recommended against size-based traffic analysis. Like DoT, a dedicated, identifiable port is blockable, and encrypted DNS can be abused for covert C2. For an analyst, an open 853/udp suggests a QUIC/DTLS encrypted-DNS resolver; confirm with a DoQ-capable client and treat unexpected hosts as possible encrypted-DNS tunneling.
- IANA assignment
domain-s— "DNS query-response protocol run over DTLS or QUIC"; reference [RFC7858][RFC8094][RFC9250]; assignee IESG/IETF Chair; registered 2015-10-08, modified 2022-04-01 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- not meaningfully ranked in nmap-services (listed "unknown", ~0.000330); growing via public resolvers [Well-established] — nmap-services file
- Related ports
- 853/tcp (DoT); 53 (cleartext Do53); 443 (DoH / DoH3 over HTTP/3); 784 (legacy DoQ experiments)
Primary use
encrypted DNS over QUIC (DoQ, RFC 9250); also DNS over DTLS (RFC 8094, Experimental)
Other/unofficial uses
encrypted-DNS tunneling / C2 (threat-reported)
Security implications
same privacy posture as DoT; QUIC 0-RTT replay caution (no replayable ops in early data); padding vs traffic analysis; dedicated port is blockable; encrypted-DNS C2 risk
Typically seen on
modern public resolvers — AdGuard DNS (first public DoQ, Dec 2020), NextDNS (early large-scale adopter), Quad9 (DoQ + DoH3 enabled March 2026)
- Analyst note
- Open 853/udp suggests a QUIC/DTLS encrypted-DNS resolver. Confirm with a DoQ-capable client; on an unexpected host consider encrypted-DNS tunneling.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| domain-s | TCP | DNS query-response protocol run over TLS/DTLS | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.