Port 53 is unusual: most queries use UDP, because a question and answer fit in one packet each, but TCP 53 is required too, for answers over the UDP size limit and for zone transfers between name servers. Firewalls that block TCP 53 cause hard-to-diagnose failures for large records such as long TXT and DNSSEC answers.
Facts
- Port
- 53
- Protocols
- UDP, TCP
- Service
- DNS
What uses port 53
DNS resolvers and authoritative name servers listen on 53. Every device sends its lookups to a resolver on port 53, unless it uses encrypted DNS (DoH on 443, DoT on 853).
On a Mac
Your Mac sends DNS queries to port 53 on its configured resolver; mDNSResponder makes them on behalf of all apps. Normally nothing on a Mac listens on 53. With Internet Sharing on, macOS runs a DNS proxy for the shared devices. Bonjour (local .local names) uses port 5353 instead.
sudo lsof -nP -iTCP:53Security
Classic DNS on 53 is unencrypted: your network and ISP can see every name you look up. Open resolvers on 53 are abused for amplification attacks, so never expose a resolver to the internet unintentionally.
Frequently asked questions
Is DNS TCP or UDP?
Both. Queries normally use UDP 53. TCP 53 is used for large responses, zone transfers and when UDP answers are truncated.
Why does my Mac use port 5353?
5353 is multicast DNS (mDNS) for Bonjour: finding printers, AirPlay speakers and other Macs by .local names on your network.
Can my ISP see port 53 traffic?
Yes, unless you use encrypted DNS. Plain DNS queries reveal every domain you look up to the network and the resolver.