Port 53 (DNS)
Domain Name System queries (UDP, and TCP for large answers and zone transfers).
- Transport
- TCP/UDP
- Internet exposure
- Restrict
Expose only to specific networks, or behind a VPN.
Security notes
- Open resolvers that answer anyone are abused for DNS amplification DDoS attacks.
- Zone transfers (AXFR) allowed to anyone reveal every name in a zone.
- Malware uses DNS for command and control and tunnelling, with long or high-entropy subdomains.
When it shows up in your logs
Clients talking DNS directly to external servers, bypassing your resolver, or very long random-looking queries, deserve a look.
Related ports
- 853
- 443 HTTPS