90
Summary
- // if you see it open
- Low practical modern risk — DNSIX has negligible internet-facing deployment. The main real-world exposure is a daemon (web server, proxy, admin panel) misbound to port 90 instead of its intended port. No DNSIX-specific CVEs or protocol-level RCE found in open sources. Not a top-scanned port, but any open listener on a routable IP will be swept by broad-range scanners (Masscan, Shodan sweeps). Recommend blocking inbound 90/tcp at the perimeter unless explicitly required by a DoD/legacy system.
- // analyst note
- An open port 90/tcp on a commercial network is much more likely a misconfigured web/admin service than DNSIX; verify what is actually listening before assuming the registered service.
About port 90/tcp.
Port 90/tcp is registered with IANA under the service name dnsix with the description "DNSIX Securit Attribute Token Map" — and yes, "Securit" is the literal spelling carried in the registry, a long-standing data-entry truncation rather than a transcription slip, confirmed by direct fetch of the IANA assignments page. Both the assignee and contact fields read [Charles_Watt], and the entry is dual-registered: 90/tcp and 90/udp carry identical data. The Reference, registration-date, and modification-date columns are all blank, so no RFC anchors this assignment and no IANA date exists to record. DNSIX itself is a U.S. Department of Defense lineage — "DoD Network Security for Information Exchange" — a scheme for attaching security-attribute tokens (classification level, originator, handling caveats) to transmitted data so receiving systems can enforce labeling and access-control policy. It belongs to legacy and specialized government infrastructure and is essentially absent from commercial deployments. The registry also carries a direct note that "PORT 90 also being used unofficially by Pointcast" — a reference to the 1990s PointCast push-content service that streamed news and stock tickers to desktop clients; PointCast is long defunct, so that use is purely historical. For an analyst, an open port 90/tcp on a public host is far more likely to be a daemon misbound to the wrong port (a web server, proxy, or admin panel parked on 90 instead of 80/8080) than a genuine DNSIX listener, since DNSIX has no meaningful internet-facing footprint. No protocol-level remote-code-execution or DNSIX-specific exploits surfaced in open sources, and port 90 does not appear in contemporary top-scanned-port lists, though any open listener on a routable IP will still be swept by broad-range scanners.
- IANA assignment
dnsix— "DNSIX Securit Attribute Token Map" ("Securit" verbatim from the registry); Reference (blank — no RFC cited); assignee and contact both[Charles_Watt]; dual-registered 90/tcp + 90/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 248–249)- Range class
- well-known / system port (0–1023) [Confirmed] — IANA registry range convention
- Registration/modification dates
- blank in IANA registry — Unknown (no date to record) [Confirmed] — IANA registry
- Related ports
- 80/tcp and 8080 (services commonly misbound here); the well-known/system port range generally
Primary use
DNSIX (DoD Network Security for Information Exchange) security-attribute token mapping — embeds classification/handling tokens in transmitted data for attribute-based access control; legacy/specialized DoD use [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=90 ; https://whatportis.com/ports/90_dnsix
Other/unofficial uses
PointCast push-content webcasting (1990s, defunct) — IANA registry note: "PORT 90 also being used unofficially by Pointcast" [Confirmed for the IANA note; PointCast usage Likely/historical] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=90 ; https://whatportis.com/ports/90_pointcast
Common software
no widely deployed modern commercial software binds port 90/tcp; historical PointCast client (defunct); DNSIX-compliant tooling is niche DoD/legacy
Security implications
low practical modern risk — DNSIX has negligible internet exposure; primary real-world vector is a daemon misbound to 90; no DNSIX-specific CVEs or RCE found in open sources; not a top-scanned port, but broad-range scanners (Masscan, Shodan sweeps) will still hit any open listener [Likely] — https://www.auditmypc.com/tcp-port-90.asp ; https://whatportis.com/ports/90_dnsix ; https://data-status.shodan.io/ports.html
Typically seen on
legacy/specialized DoD or government hosts; otherwise an anomaly or a service misbound to the wrong port
- Analyst note
- An open port 90/tcp on a commercial network is much more likely a misconfigured web/admin service than DNSIX; verify what is actually listening before assuming the registered service.
About port 90/udp.
Port 90/udp is registered with IANA as dnsix with the description "DNSIX Securit Attribute Token Map" (the missing trailing "y" is a typo carried from the original Assigned Numbers document, not a transcription error), assignee Charles Watt, and a blank reference field — and it is dual-registered identically on both TCP and UDP. DNSIX stands for "DoD Network Security for Information Exchange," a legacy U.S. Department of Defense scheme for embedding security-attribute tokens — classification level, user role, data origin — into network traffic so that downstream systems in multi-level-security (MLS) environments can enforce granular access controls. The assignment traces back to RFC 1340 (Assigned Numbers, July 1992, since obsoleted by RFC 1700), where the same "Securit" spelling appears; no current RFC is cited in the IANA registry for this port, so the IANA Reference column is recorded blank. The IANA registry row also carries an assignment note: "PORT 90 also being used unofficially by Pointcast." PointCast was a 1990s push-technology news-delivery service (beta-launched February 1996, shut down in 2000) that informally used port 90 for content-stream delivery; that usage was never official and is entirely defunct. For an analyst, 90/udp is essentially a vestigial assignment: DNSIX is a niche DoD/MLS protocol with no publicly documented active implementations, the only known open-internet user (PointCast) is long dead, and the port carries negligible mass-scan exposure and no recorded CVEs or malware association. A responsive 90/udp today is therefore an anomaly worth investigating rather than a recognizable mainstream service, and the sensible default posture is to filter inbound 90/udp at the perimeter unless a specific legacy DNSIX deployment requires it.
- IANA assignment
dnsix— "DNSIX Securit Attribute Token Map" (sic — original typo); reference (blank — no RFC cited in IANA registry); assignee Charles Watt; dual-registered 90/tcp + 90/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 249)- Range class
- well-known (0–1023)
- Related ports
- DNSIX cluster (195 dnsix-ll, 196 dnsix-au sibling assignments); contrast modern MLS/labeling mechanisms
Primary use
DNSIX (DoD Network Security for Information Exchange) security-attribute token mapping for multi-level-security (MLS) environments; original assignment in RFC 1340 (Assigned Numbers, July 1992; obsoleted by RFC 1700)
Other/unofficial uses
historical unofficial use by PointCast push-technology news service (beta Feb 1996, shut down 2000); flagged in IANA assignment note "PORT 90 also being used unofficially by Pointcast" [Confirmed (registry note) / Likely (PointCast detail single-source)] — IANA registry note; Wikipedia (PointCast)
Common software
no commercially maintained or open-source software is known to actively implement DNSIX on 90/udp as of 2026; any surviving use is undocumented legacy/government infrastructure
Security implications
negligible internet-scan exposure; no CVEs or active exploit campaigns specifically targeting 90/udp in public sources as of June 2026; not in standard mass-scan UDP target sets; no Trojan/malware association noted; an open UDP port is not dangerous in itself, but any service bound to 90/udp could be reachable if firewall rules permit — recommended posture is to block/filter inbound 90/udp unless a specific DNSIX deployment requires it
Typically seen on
legacy DoD/MLS infrastructure (undocumented); otherwise an anomaly worth investigating
- Analyst note
- A responsive 90/udp is statistically rare with no recognizable mainstream service behind it — treat it as an anomaly (decoy, misconfiguration, or obscure legacy service) and investigate; legitimate public use is unlikely.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| dnsix | TCP | DNSIX Securit Attribute Token Map | 0.07% |
| dnsix | UDP | DNSIX Securit Attribute Token Map | 0.05% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.