In one sentence: Port 53 is the door for the Domain Name System, the internet’s address book that turns a website name into the number a computer needs.

What runs on this port

DNS translates names such as wolfcore.co.uk into the numeric addresses that machines use. RFC 1035 states that name servers are reached by TCP on server port 53 as well as by UDP on port 53.

UDP is the quick, light option for ordinary questions. RFC 1035 says UDP messages are limited to 512 bytes and longer ones are truncated, with the TC bit set, which tells the asker to try again. RFC 7766 requires DNS implementations to support TCP as well.

Two roles matter. An authoritative server holds the records for your domain and must be reachable. A resolver answers questions on behalf of your staff and normally only needs to be reachable from your own network.

Why attackers look for it

If an attacker can alter an answer, they can send a customer to the wrong place. MITRE also lists DNS among the alternative protocols attackers use to take data out of a network.

DNS servers are also reachable by design, so flaws in the software can be reached from outside.

How it gets attacked

• Forged answers (cache poisoning). CVE-2008-1447: the National Vulnerability Database (NVD) records that the DNS protocol as implemented in BIND and Microsoft DNS allowed attackers to spoof DNS traffic through a birthday attack, because of insufficient randomness in transaction IDs. RFC 5452 describes how to make this many orders of magnitude harder.
• Server software flaws. CVE-2020-1350: the NVD records a remote code execution flaw in Windows DNS Server, scored 10.0 on CVSS v3.1 and listed in CISA’s Known Exploited Vulnerabilities catalogue, added 3 November 2021.
• Data theft and tunnelling. MITRE lists DNS as a protocol attackers use for exfiltration.
• Weak records. Dangling records and expired domains can be taken over, as the subdomain takeover entry explains.

Who it affects and how badly

• Sole trader to 10 staff: your domain records are held by a registrar. Worst case: a changed record sends your website or email to an attacker.
• 10 to 50 staff: any firm running its own Windows DNS Server inside its network.
• 50 to 250 staff: SaaS start-ups and MSPs whose customers rely on their names resolving. Downtime means customers cannot reach the service.
• Regulated businesses and telecoms: DNS outages and manipulation affect many customers at once.

How to check whether yours is exposed

• Read firewall rules for inbound UDP and TCP port 53 and ask which server each rule points to.
• List every DNS server you run, and note its role: authoritative or resolver.
• Confirm that a resolver for your staff is not answering queries from the internet.
• Check the records in your domain registrar and hosting panels for entries you do not recognise.
• Run the free web vulnerability scan and check your public addresses from outside your network.

How to secure it

1. Do not run your own DNS if a managed provider can host it.
2. Install updates for DNS server software promptly, and take known exploited flaws first.
3. Allow inbound port 53 only to authoritative servers, and keep internal resolvers private.
4. Allow both UDP and TCP on port 53 where needed (RFC 7766).
5. Turn on DNSSEC for your domains, which adds data origin authentication and data integrity (RFC 4033).
6. Use registrar locks and multi-factor authentication on your domain account.
7. Remove unused records, which also helps stop subdomain takeover.
8. Monitor DNS logs for unusual query volumes.

Related terms

• how dns spoofing works
• how subdomain takeover works
• port 25 smtp
• denial of service
• nmap
• indicators of compromise

Frequently asked questions

Does DNS use UDP or TCP?
Both. RFC 1035 states that name servers are reached on port 53 by TCP and by UDP, and RFC 7766 requires support for TCP.

What does DNSSEC do?
RFC 4033 says it adds data origin authentication and data integrity to DNS.

How serious was CVE-2020-1350?
The NVD records it as a remote code execution flaw in Windows DNS Server with a CVSS v3.1 score of 10.0, and CISA lists it as exploited.

Sources

• RFC 1035, Domain Names: Implementation and Specification: https://www.rfc-editor.org/rfc/rfc1035.txt
• RFC 7766, DNS Transport over TCP: https://www.rfc-editor.org/rfc/rfc7766.txt
• RFC 4033, DNS Security Introduction and Requirements: https://www.rfc-editor.org/rfc/rfc4033.txt
• NVD record for CVE-2020-1350 (Windows DNS Server): https://nvd.nist.gov/vuln/detail/CVE-2020-1350
• NVD record for CVE-2008-1447 (DNS cache poisoning): https://nvd.nist.gov/vuln/detail/CVE-2008-1447
• MITRE ATT&CK T1048 Exfiltration Over Alternative Protocol: https://attack.mitre.org/techniques/T1048/

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.