Port 853: DNS over TLS

What is port 853 used for?

Clients and resolvers that want private DNS lookups.

Is it safe to expose port 853 to the internet?

Fine on a resolver you intend to offer; restrict it to your own clients so it does not become an open resolver.

If port 853 seems closed or unreachable

1. Check that the DNS over TLS service is running and listening on port 853, not only on 127.0.0.1.
2. Check the firewall on the host itself (Windows Defender Firewall, iptables, nftables, ufw) for a rule that allows TCP 853.
3. If the host is behind a router, confirm the forwarding rule points to the correct internal address and that your internet provider does not use carrier-grade NAT.
4. Test from outside your own network. A port can be open locally and blocked at the edge, or the other way round.

Using port 853 safely

Port 853 can be exposed when the host exists to provide this service, but add controls: restrict source addresses where you can, require strong authentication and encryption, and monitor the logs for repeated failures.

Related ports