Port 853: DNS over TLS

What is port 853 used for?

Encrypted DNS lookups (DoT), used by Android Private DNS and many resolvers.

Should port 853 be open?

Usually open to the internet. This port is meant to be reachable publicly on servers that offer the service. Public resolvers such as 1.1.1.1 and 8.8.8.8 accept DoT on 853. Some networks block it.

See what is listening on port 853

# Linux
sudo ss -tlnp | grep ':853 '

# macOS
sudo lsof -nP -i TCP:853 -sTCP:LISTEN

# Windows (PowerShell)
Get-NetTCPConnection -LocalPort 853 -State Listen

Open or block port 853 in a firewall

# Ubuntu / Debian (ufw)
sudo ufw allow 853/tcp
sudo ufw deny 853/tcp

# Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Port 853" -Direction Inbound -Protocol TCP -LocalPort 853 -Action Allow

On cloud servers, also open the port in the provider’s security group or network firewall. At home, a service behind a router needs a port-forwarding rule to the device’s local IP.

Test it from outside

A port can be open on the server but blocked upstream. The Port Checker connects from the internet, so it shows what the world sees. From your own machine, use nc -vz example.com 853 (macOS/Linux) or Test-NetConnection example.com -Port 853 (Windows).