TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Port 53 cannot be used for DNS-over-HTTPS service. Please us

Error message

Port 53 cannot be used for DNS-over-HTTPS service. Please use a different port.

What it means

Thrown by the DnsOverHttpsPort setter when value == 53 (second guard, after the range check 314 passes). Port 53 is reserved for plain DNS, so DNS-over-HTTPS must use a different port.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7789

                    throw new ArgumentOutOfRangeException(nameof(DnsOverTlsPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverTlsPort), "Port 53 cannot be used for DNS-over-TLS service. Please use a different port.");

                _dnsOverTlsPort = value;
            }
        }

        public int DnsOverHttpsPort
        {
            get { return _dnsOverHttpsPort; }
            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpsPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpsPort), "Port 53 cannot be used for DNS-over-HTTPS service. Please use a different port.");

                if (value == 853)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpsPort), "Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTPS service.");

                _dnsOverHttpsPort = value;
            }
        }

        public int DnsOverQuicPort
        {
            get { return _dnsOverQuicPort; }
            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverQuicPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverQuicPort), "Port 53 cannot be used for DNS-over-QUIC service. Please use a different port.");

View on GitHub (pinned to d0484b6c1e)

Solutions

Use 443 or another non-53 port for DoH.
Keep plain DNS on 53 and run DoH on a dedicated port.
Pre-validate the DoH port is not 53 (or 853) before assigning.
Re-submit the corrected port via the settings API.

Example fix

// before
_dnsServer.DnsOverHttpsPort = 53;  // throws: 53 reserved for plain DNS

// after
_dnsServer.DnsOverHttpsPort = 443;  // conventional HTTPS port

Defensive patterns

Strategy: validation

Validate before calling

if (parsed == 53) parsed = 443; // 53 reserved for plain DNS
_dnsServer.DnsOverHttpsPort = parsed;

Type guard

static bool IsAcceptableDohsPort(int value) => value != 53 && value != 853 && value >= 0 && value <= 65535;

Try / catch

try { _dnsServer.DnsOverHttpsPort = parsed; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(DnsServer.DnsOverHttpsPort) && parsed == 53)
{ _dnsServer.DnsOverHttpsPort = 443; }

Prevention

Never reuse 53 for DoH (HTTPS).
Map migrated 53 values to 443 before assignment.
Reserve 53 for plain DNS.

When it happens

Trigger: Assigning DnsServer.DnsOverHttpsPort = 53 via the settings API or config restore. Range guard passes; this guard then fires.

Common situations: Assuming DoH (HTTPS) can share port 53 with plain DNS. Config migration leaving the value at 53. Confusing plain DNS port with the DoH port.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/e3bbcd8d94eb8486. Report an issue: GitHub.