TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Port 53 cannot be used for DNS-over-HTTP service. Please use

Error message

Port 53 cannot be used for DNS-over-HTTP service. Please use a different port.

What it means

Thrown by the DnsOverHttpPort setter after the range check passes, specifically when value == 53. Port 53 is the standard DNS port and is reserved for plain DNS; the server forbids hosting DNS-over-HTTP on it to avoid ambiguity with the normal DNS listener.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7732

            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverTcpProxyPort), "Port number valid range is from 0 to 65535.");

                _dnsOverTcpProxyPort = value;
            }
        }

        public int DnsOverHttpPort
        {
            get { return _dnsOverHttpPort; }
            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), "Port 53 cannot be used for DNS-over-HTTP service. Please use a different port.");

                if (value == 853)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), "Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTP service.");

                _dnsOverHttpPort = value;
            }
        }

        public string DnsOverHttpUnixSocket
        {
            get { return _dnsOverHttpUnixSocket; }
            set
            {
                if (string.IsNullOrWhiteSpace(value))
                    value = null;

                _dnsOverHttpUnixSocket = value;
            }

View on GitHub (pinned to d0484b6c1e)

Solutions

Pick a different port for DoH, e.g. 8053, 443, or 3000.
Leave plain DNS on 53 and host DoH on a dedicated port.
Validate before assignment that the DoH port is not 53 (nor 853 — see 311).
Correct the settings API payload and re-submit.

Example fix

// before
_dnsServer.DnsOverHttpPort = 53;  // throws: 53 reserved for plain DNS

// after
_dnsServer.DnsOverHttpPort = 8053; // dedicated DoH port

Defensive patterns

Strategy: validation

Validate before calling

if (parsed == 53) parsed = 8053; // port 53 reserved for plain DNS
_dnsServer.DnsOverHttpPort = parsed;

Type guard

static bool IsAcceptableDohPort(int value) => value != 53 && value != 853 && value >= 0 && value <= 65535;

Try / catch

try { _dnsServer.DnsOverHttpPort = parsed; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(DnsServer.DnsOverHttpPort) && parsed == 53)
{ _dnsServer.DnsOverHttpPort = 8053; }

Prevention

Never reuse 53 for DoH; reserve it for plain DNS.
Map any 53 from migrated config to a safe default before assignment.
Pre-validate against the reserved-port list.

When it happens

Trigger: Assigning DnsServer.DnsOverHttpPort = 53 via the settings API (WebServiceSettingsApi.cs:1195) or config load. The range guard at 309 passes (53 is in range), then this dedicated guard fires.

Common situations: Assuming DoH can reuse the standard DNS port 53. Copying a config that defaulted the DoH port to 53. UI confusion between the plain-DNS listener port and the DoH port.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/333f0e015e70a120. Report an issue: GitHub.