DNS Port Numbers Explained: Port 53, Port 853 for DoT and DoQ, and 443 for DoH and DNSCrypt

Hop 01

Port 53: the original DNS port over UDP and TCP

RFC 1035 is short on this point. Section 4.2.1 says messages sent using UDP use server port 53, and section 4.2.2 says the same for TCP. Over UDP a message was limited to 512 bytes, and anything longer was cut off with the TC (truncated) bit set in the header, which told the client to ask again.

Over TCP each message is prefixed with a two-byte length field, because a TCP stream has no natural message boundaries. That framing outlived its origin: RFC 9250 reuses the same two-byte length prefix for every DNS over QUIC message. When people search for the DNS port, port 53 is almost always the answer they are after.

Nothing on port 53 is encrypted. Every query and answer crosses the network in plain text, readable by anyone on the path and easy to rewrite. That is the whole reason the newer port numbers exist, and it is why the DNSCrypt FAQ recommends 443 over 53, noting that routers frequently hijack traffic sent to the old port.

Hop 02

Why TCP on port 53 is not optional

For years TCP was treated as a fallback for oversized answers. RFC 7766, published in March 2016, ended that view. It states that TCP support is a required part of a full DNS implementation and that general-purpose DNS software must support both UDP and TCP. TCP, it says, is a valid transport in its own right.

The practical reason is size. DNSSEC signatures make answers larger, and RFC 7766 notes that truncation at the 512-byte limit has become common. A firewall rule that allows UDP on port 53 but drops TCP therefore breaks lookups in ways that look random: small answers work, large ones time out, and the failures follow whichever domains happen to be signed.

Hop 03

Port 853 for DNS over TLS and DNS over QUIC

RFC 7858 gave DNS over TLS its own number in May 2016. A server that supports it must listen on TCP port 853 by default, and nobody may use port 853 for cleartext DNS. Another port is allowed only by mutual agreement, and port 53 is excluded, so an encrypted session never shares a number with plain queries.

DNS over QUIC, standardised in RFC 9250 in 2022, reuses port 853 but over UDP, since QUIC runs on UDP. The RFC forbids port 53 for DoQ and mentions 443 as a possible alternative by agreement, because it is less likely to be blocked. Quad9 publishes alternates of its own: 8853 for DNS over TLS and 9953 for plain DNS.

A dedicated port 853 has one clear advantage: a network administrator can see at a glance that a device is using encrypted DNS. It has one clear drawback for the same reason. The DNSCrypt FAQ puts it bluntly, saying port 853 is easy to block exactly where encryption matters most, on hostile or tightly managed networks.

Hop 04

Port 443: where DoH and DNSCrypt live

DNS over HTTPS, RFC 8484 from October 2018, defines no port of its own. It sends DNS messages as HTTPS requests and so inherits port 443, which Cloudflare’s documentation calls the default port for HTTPS. With HTTP/3 the same requests travel over UDP 443, as the dnscrypt-proxy configuration notes for its http3 option.

DNSCrypt chose 443 deliberately. The protocol specification says the default port should be 443 for both TCP and UDP, and the FAQ adds that regular DNS and DNSCrypt can share one port. Operators may deviate: AdGuard DNS publishes its DNSCrypt server on port 5443, and each stamp in the resolver directory carries the exact address and port.

Hop 05

DNS port numbers at a glance

Protocol	Transport	Default port	Defined in
Plain DNS	UDP and TCP	53	RFC 1035, RFC 7766
DNS over TLS (DoT)	TCP	853	RFC 7858
DNS over QUIC (DoQ)	UDP	853	RFC 9250
DNS over HTTPS (DoH)	TCP (UDP with HTTP/3)	443	RFC 8484
DNSCrypt v2	UDP and TCP	443	dnscrypt.info protocol spec

Hop 06

Why the DNS port decides what a firewall can block

A firewall works on numbers before content. Blocking port 853 takes one rule and stops every DoT and DoQ client on the network. Blocking port 53 to outside servers forces devices onto the local resolver, which lets the network’s own resolver and filters apply to every device. Blocking 443 would break the web, so that rule is rare.

That is the trade-off behind the protocol choice on the encrypted DNS overview. DoT on port 853 is easy to recognise and easy to stop. DoH and DNSCrypt on 443 blend into ordinary traffic, which is why they keep working on restrictive networks. The comparison table lines the protocols up against each other on this and other properties.

There is one more port worth knowing about on your own machine. dnscrypt-proxy listens on 127.0.0.1:53 by default, according to its example configuration, so applications keep sending ordinary queries to port 53 locally while the proxy encrypts them on the way out. If another service already occupies that local port, the proxy cannot start until one of them moves.

Hop 07

Testing a DNS port from the command line

BIND’s dig tests each transport. dig +tcp example.com @9.9.9.9 forces TCP on port 53 and shows whether a firewall drops it. Swap +tcp for +tls to try DNS over TLS on port 853, its manual default, or for +https to try DoH on 443. A timeout on one and an answer on another points at the blocked DNS port.

Cloudflare documents a kdig variant for DNS over TLS that also checks the certificate: kdig -d @1.1.1.1 +tls-ca +tls-host=one.one.one.one example.com. If port 853 fails everywhere you test, switch the client to a DoH or DNSCrypt server on 443; the DNS over TLS page and the DNS over HTTPS page explain the setup for each protocol.