53/TCP + UDPDNS
Network services · Well-known port · OSI layer 7
Name resolution: domain to IP address. Queries usually use UDP; large responses and zone transfers use TCP.
IANA: officially registered as domain
Look up and open a port
Port 53: Look up and open the DNS port
Port 53 is used for DNS over both UDP and TCP. The tool shows you the port details and generates firewall commands for both protocols.
Built by Justin Schuessler
Try the commands on your own VPS, with root access and your own firewall.
Add multiple ports one at a time, up to 12.
Or choose a preset
Ports
Firewall rule (inbound)
Firewall commands
Open port
sudo ufw allow 53/tcp
sudo ufw allow 53/udpNotes on ufw
For Ubuntu and Debian. ufw creates the rule for both IPv4 and IPv6. If ufw is disabled, allow SSH first (sudo ufw allow 22/tcp), then enable it with sudo ufw enable, or you'll lock yourself out.
On a ZAP-Hosting VPS with an active network firewall, you also need to allow the port in the Customer Panel.
Port 53 explained
What is port 53 used for?
Purpose
Port 53 handles queries to the Domain Name System, which translates names such as zap-hosting.com into IP addresses. Standard queries are small and usually use UDP because it's faster. TCP is used for large responses and zone transfers between DNS servers. You only need inbound port 53 on a server if you run a DNS server yourself, such as BIND, Unbound or PowerDNS.
Origin and standard
DNS was standardized in 1987 in RFC 1034 and RFC 1035, replacing the old system of centralized hosts files. IANA lists port 53 for TCP and UDP under the name “domain”. For a long time, TCP was considered a fallback for zone transfers. RFC 7766 now requires DNS servers and resolvers to support queries over TCP as well.
Typical use
- Authoritative nameserver for your own domains
- Recursive resolver on the internal network, for example using Unbound or Pi-hole
- Zone transfers between primary and secondary DNS servers over TCP
- Outgoing DNS queries from each server to resolve hostnames
Security
An open resolver that answers recursive queries from anywhere on the internet is quickly abused for DNS amplification DDoS attacks. Attackers send small queries with a spoofed source address, and your server sends large responses to the victim. Only an authoritative nameserver should respond to internet queries, and only for its own zones. Make a resolver available only to your internal network or through a VPN. Allow zone transfers only to your secondary nameservers.
More ports
Related ports
These ports are often part of the same setup. Click one to see its explanation and firewall commands.
View all well-known ports and the complete IANA list
Port list source: IANA Service Name and Transport Protocol Port Number Registry, as of October 22, 2026. iana.org
Discover more
More tools
Subnet Calculator
Calculate the network address, broadcast address, subnet mask, and usable host range from a CIDR address, and convert between CIDR and IP ranges (IPv4 and IPv6).
Built by Jakub Martyniak
OSI model
NewInteractively learn the 7 layers of the OSI model: click layers, assign terms such as switch, ARP, or port 443, and explore animated encapsulation, a quiz, and a cheat sheet for the IHK exam.
Built by Justin Schuessler
TCP/IP model
NewInteractively learn the 4 layers of the TCP/IP model (DoD model) according to RFC 1122, with OSI model mapping, animated encapsulation, a port quiz, and a cheat sheet.
Built by Justin Schuessler
Port Checker
Check whether specific ports are open on an IP or hostname—select a protocol or game instead of scanning all ports at once.
Built by Sebastian Rademacher
FAQ
Frequently asked questions
Quick answers about port 53.
Both. Regular DNS queries use UDP; large responses and zone transfers use TCP. A DNS server should therefore allow both UDP and TCP on port 53.
With ufw, allow both protocols: sudo ufw allow 53/udp and sudo ufw allow 53/tcp. With firewalld, run sudo firewall-cmd --permanent --add-port=53/udp and sudo firewall-cmd --permanent --add-port=53/tcp, followed by sudo firewall-cmd --reload. Only open the port if a DNS server is actually running on the system.
An open resolver answers recursive DNS queries from any address on the internet. Such servers are abused for DNS amplification attacks. Restrict recursion to your own network.
No, unless you run your own DNS server. Normal name resolution only needs outgoing queries, which most firewalls allow by default. You only need to open port 53 for incoming traffic if you run your own nameserver.
Any more questions?
Contact SupportYour own server?
Try the commands on your own VPS
With a ZAP-Hosting VPS, you have root access, can set up services and firewall rules yourself, and can immediately see which ports are open.
4.4/5 Trustpilot32,000+ Active serversSince 2010
No setup. No risk. Online in seconds.
Flexible TermCancel anytimeOnline in 60 seconds
Looking for more tools? View all network tools