Port 53 · TCP/UDP

Port 53: DNS

The Domain Name System: turning names like netsecwall.com into IP addresses. Queries use UDP, and fall back to TCP for large answers.

Protocol
TCP/UDP
On Windows
svchost.exe (DNS Client service, Dnscache)
Risk if open to the internet
Medium

Seeing it on your PC

svchost.exe sending UDP 53 to your router or to the DNS server you configured is Windows looking up names. A program that sends its own DNS queries to a different server is going around your DNS settings, which some apps do on purpose and some malware does to avoid filtering.

Should you block it?

Never block outgoing DNS to the server you use, or nothing will load. Nothing should listen on 53 unless you run a DNS server.

Check it on your PC

Run this in PowerShell to see what is using port 53 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 53 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}
Get-NetUDPEndpoint -LocalPort 53 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.