What uses port 853
DNS over TLS sends normal DNS queries inside a TLS connection on TCP 853, so networks in between can’t see or alter which names you look up. Android’s Private DNS setting, systemd-resolved and many routers support it. Because it uses a dedicated port, networks can block DoT easily, unlike DNS over HTTPS on 443.
Should port 853 be open to the internet?
Meant to be public. This port is meant to be reachable by clients on the internet when you run this service publicly.
Check what is listening on port 853
sudo ss -ltnp 'sport = :853'sudo lsof -nP -iTCP:853 -sTCP:LISTENGet-NetTCPConnection -LocalPort 853 -State Listen
netstat -ano | findstr :853No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 853
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:853 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 853 -State Listen).OwningProcessOpen port 853 in the firewall
sudo ufw allow 853/tcp
# Close it again:
sudo ufw delete allow 853/tcpsudo firewall-cmd --permanent --add-port=853/tcp
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "DNS over TLS 853/TCP" -Direction Inbound -Protocol TCP -LocalPort 853 -Action AllowOn AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 853 from another machine
nc -zv example.com 853Test-NetConnection example.com -Port 853Related ports
- Port 53 (DNS): used by DNS to translate domain names into IP addresses.
- Port 443 (HTTPS): the default port for HTTPS, encrypted web traffic.
More network services ports
67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 389 (LDAP) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 853 used for?
Port 853 is used by DNS over TLS (DoT) for encrypted DNS queries. DNS over TLS sends normal DNS queries inside a TLS connection on TCP 853, so networks in between can’t see or alter which names you look up. Android’s Private DNS setting, systemd-resolved and many routers support it. Because it uses a dedicated port, networks can block DoT easily, unlike DNS over HTTPS on 443.
Is it safe to open port 853?
This port is meant to be reachable by clients on the internet when you run this service publicly. Keep the service behind it up to date and require authentication where it applies.
How do I check if port 853 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :853'" on Linux or "sudo lsof -nP -i :853" on macOS. From another machine, run "nc -zv host 853" or, on Windows, "Test-NetConnection host -Port 853". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.