Traditional DNS uses port 53 for both UDP and TCP. Ordinary lookups commonly go to a DNS server on UDP port 53. TCP port 53 is also part of DNS: when a UDP response is truncated, the client can send the request again over TCP.
The firewall-relevant detail is easy to miss. Port 53 is usually the DNS server’s port. The client sends from a temporary high-numbered source port, then receives the reply from source port 53 at that temporary port.
DNS port numbers in a typical lookup
- Query: temporary client source port to DNS server destination port 53.
- Reply: DNS server source port 53 to the client’s temporary destination port.
- Transport: UDP is the usual transport for DNS lookups; TCP port 53 can be used after a truncated UDP response.
Microsoft’s Windows Server documentation gives a concrete dynamic-port example: its default range is 49152 through 65535, and its DNS traffic table describes the client-side port as random and 49152 or higher. That is a Windows Server default, not a universal rule for every operating system.
Why DNS uses UDP and TCP on the same port
A DNS server can send a UDP response up to the default 512-octet datagram size described by Microsoft. If the response exceeds that size, the server marks it truncated. The client can then reissue the request over TCP port 53.
EDNS changes the old 512-octet mental model. A DNS requestor can advertise the UDP packet size it accepts, and the server can scale its UDP response to that maximum. TCP port 53 remains relevant when a client retries after truncation.
Infoblox says that blocking the TCP fallback can produce slow DNS resolution or prevent resolution for some names. Allowing UDP port 53 while blocking TCP port 53 can therefore create failures that only show up on certain responses.
What this means for firewall rules
For a DNS client, DNS traffic goes from a temporary client port to destination port 53 on its configured resolver, over UDP and potentially TCP. Return traffic comes from source port 53 to the client’s temporary port.
For a DNS server, queries reach destination port 53. Oracle’s documentation independently lists DNS lookup on port 53 for both TCP and UDP. A rule set that accounts only for UDP 53 leaves out the TCP path DNS clients can use after a truncated UDP response.
- Client traffic: temporary source port to resolver destination port 53.
- Server replies: source port 53 to the client’s temporary destination port.
- Both transports: account for UDP 53 and TCP 53 where traditional DNS traffic must work.
DNS does not usually choose a website’s port
“DNS port 53” is the port used to ask DNS for an answer. It is separate from the application port used after name resolution. Ordinary DNS records point a name to an IP address; they do not tell HTTP or HTTPS clients to use a nonstandard port.
SRV records are a limited exception. They can provide port information for protocols whose specifications require SRV lookups. They do not change how HTTP and HTTPS select their usual ports.
A Windows Server packet-flow example
In the Windows Server range Microsoft documents, a system might send a DNS lookup from UDP source port 53000 to destination port 53. The resolver replies from UDP source port 53 to destination port 53000. If the response is truncated and the system retries over TCP, the new exchange still targets destination port 53.
Frequently asked questions
Should a firewall account for both UDP and TCP port 53 for DNS?
Traditional DNS uses port 53 with both transports. UDP commonly carries the initial lookup, while a client can retry over TCP port 53 after a truncated UDP response. Blocking that TCP path can lead to slow resolution or failures for some names.
Why does DNS use a high-numbered client port?
The DNS server uses port 53, while the client generally sends from a temporary high-numbered source port. The reply comes from port 53 and returns to that temporary client port. Microsoft documents 49152 through 65535 as the default dynamic range in its Windows Server context.
Can DNS point a domain name to a specific port?
Ordinary DNS records map names to addresses rather than selecting an application port for HTTP or HTTPS. SRV records can provide port information only for protocols designed to query SRV records.
Sources
- Network Ports Used by DNS | Microsoft Learn — learn.microsoft.com
- Default Port Numbers - Oracle Help Center — docs.oracle.com
- Is DNS TCP or UDP port 53? - Infoblox — www.infoblox.com
- Can DNS point to specific port? - Webmasters Stack Exchange — webmasters.stackexchange.com
