Common attacks and weaknesses
- Open resolvers abused for DDoS amplification.
- Zone transfers (AXFR) leaking the full list of hosts.
- DNS tunneling used for command and control or data exfiltration.
Port 53: DNS
Name resolution. UDP for most queries, TCP for large answers and zone transfers.
53
How DNS works
Network servicesThe computer asks a DNS server for the address behind a name, and gets an IP address back. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 4/10 moderate if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Network services
Is port 53 dangerous?
How to secure it
- Do not run open recursive resolvers on the Internet.
- Restrict AXFR to secondary servers.
- Log and monitor queries for tunneling patterns (long, random subdomains).
IANA registry entries for port 53
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| domain | 53 | TCP, UDP | Domain Name Server | - | - |
// source: IANA service name and port number registry
Which program uses port 53, and is it reachable?
Linux
sudo ss -ltnup 'sport = :53' # process listening on 53
sudo lsof -nP -i :53macOS
sudo lsof -nP -i :53
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 53 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 53 netstat -ano | findstr :53
From another machine
nmap -p 53 -sV <host> sudo nmap -sU -p 53 <host> nc -zv <host> 53
Block it in the firewall
sudo ufw deny 53/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 53" -Direction Inbound -LocalPort 53 -Protocol TCP -Action Block # Windows
What is port 53 used for?
Name resolution. UDP for most queries, TCP for large answers and zone transfers.
Is port 53 TCP or UDP?
Port 53 is registered for TCP and UDP.
Is it safe to open port 53?
It is rated 4/10 (moderate) when exposed to the Internet. Open resolvers abused for DDoS amplification. Do not run open recursive resolvers on the Internet.
How do I check if port 53 is open?
On Linux run "ss -ltnup 'sport = :53'", on macOS "lsof -nP -i :53", and on Windows "netstat -ano | findstr :53" to see the local process. From another machine, "nmap -p 53 <host>" shows whether it is reachable.
Other network services ports
:135 MS RPC tcp · udp · high risk :123 NTP udp · tcp · moderate risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk :5355 LLMNR udp · tcp · high risk