Why Is Port 53 Occupied? Uncovering DNS Services and Systemd-Resolve on Linux

In Linux, port 53 is commonly associated with the Domain Name System (DNS) service. This article details a scenario involving port 53 and shows how to use command‑line tools to analyze and understand the situation.

Phenomenon

Users may encounter output similar to the following:

systemd-r 20245 systemd-resolve   13u  IPv4 216305        calhost:domain
systemd-r 20245 systemd-resolve   14u  IPv4 216306        lhost:domain (LISTEN)

The two lines show that the systemd-resolve process is listening on the local DNS port, one via UDP and the other via TCP.

Analysis

UDP connection

The systemd-resolve process has file descriptor 13.

This is a UDP connection.

The connection uses an IPv4 address (IPv4 216305).

The connection is on localhost’s DNS port.

TCP listening

The systemd-resolve process has file descriptor 14.

This is a TCP listener (LISTEN).

The listener also uses an IPv4 address (IPv4 216306).

The listener is on localhost’s DNS port.

Service explanation

These details indicate that the system is running a DNS resolution service. The systemd-resolve process handles DNS queries via both UDP (for simple queries) and TCP (for larger or more complex transfers).

Solution

Check which process occupies port 53, for example with: sudo netstat -nultp If the port is used by systemd-resolved, you can resolve the issue by following these steps:

Stop the systemd-resolved service: sudo systemctl stop systemd-resolved Edit /etc/systemd/resolved.conf (enter insert mode with i).

Modify the file as shown below and save with :wq:

[Resolve]
DNS=223.5.5.5         # uncomment and set DNS
#FallbackDNS=
#Domains=
#LLMNR=no
#MulticastDNS=no
#DNSSEC=no
#DNSOverTLS=no
#Cache=no-negative
DNSStubListener=no    # change yes to no
#ReadEtcHosts=yes

Finally, recreate the resolv.conf symlink:

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Conclusion

Port 53 is normally occupied by DNS services; on Linux the systemd-resolve process manages DNS resolution. If other DNS services such as BIND or dnsmasq are present, they may also use port 53. Understanding this information helps users monitor DNS activity and adjust configurations as needed.