Core network servicesTCP/UDP 53 Cleartext by default
Port 53: DNS
Domain Name System
Translates names to IP addresses. Queries use UDP; zone transfers and large responses use TCP.
Secure alternative: DNS over TLS (853) or DNS over HTTPS (443) for privacy; DNSSEC for integrity
How attackers abuse it
- Cache poisoning and spoofed responses redirecting users.
- Unrestricted zone transfers (AXFR) leaking the internal map of a domain.
- DNS tunnelling for command and control or data exfiltration.
- Open resolvers used for amplification DDoS.
How to defend it
- DNSSEC to validate responses; restrict zone transfers to secondaries.
- Disable open recursion; rate-limit responses.
- Monitor for long, high-entropy queries that suggest tunnelling.
Exam tip
DNSSEC provides integrity and authenticity, not confidentiality. DoT and DoH provide confidentiality.