TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Port 853 is reserved for DNS-over-TLS service. Please use a

Error message

Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTPS service.

What it means

Thrown by the DnsOverHttpsPort setter when value == 853 (third and final guard, after range 314 and port-53 315 checks pass). Port 853 is reserved for DNS-over-TLS; DNS-over-HTTPS is not allowed to bind it, preventing a collision between the two encrypted transports.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7792

                    throw new ArgumentOutOfRangeException(nameof(DnsOverTlsPort), "Port 53 cannot be used for DNS-over-TLS service. Please use a different port.");

                _dnsOverTlsPort = value;
            }
        }

        public int DnsOverHttpsPort
        {
            get { return _dnsOverHttpsPort; }
            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpsPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpsPort), "Port 53 cannot be used for DNS-over-HTTPS service. Please use a different port.");

                if (value == 853)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpsPort), "Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTPS service.");

                _dnsOverHttpsPort = value;
            }
        }

        public int DnsOverQuicPort
        {
            get { return _dnsOverQuicPort; }
            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverQuicPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverQuicPort), "Port 53 cannot be used for DNS-over-QUIC service. Please use a different port.");

                _dnsOverQuicPort = value;
            }

View on GitHub (pinned to d0484b6c1e)

Solutions

Use 443 (or another free non-853 port) for DoH; reserve 853 for DoT.
If you want port 853, enable DNS-over-Tls and configure DnsOverTlsPort instead.
Pre-validate the DoH port is neither 53 nor 853 before assigning.
Re-submit the corrected port via the settings API.

Example fix

// before
_dnsServer.DnsOverHttpsPort = 853;  // throws: 853 reserved for DoT

// after
_dnsServer.DnsOverHttpsPort = 443;   // DoH on 443

Defensive patterns

Strategy: validation

Validate before calling

if (parsed == 853) parsed = 443; // 853 reserved for DoT
_dnsServer.DnsOverHttpsPort = parsed;

Type guard

static bool IsAcceptableDohsPort(int value) => value != 53 && value != 853 && value >= 0 && value <= 65535;

Try / catch

try { _dnsServer.DnsOverHttpsPort = parsed; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(DnsServer.DnsOverHttpsPort) && parsed == 853)
{ _dnsServer.DnsOverHttpsPort = 443; }

Prevention

Keep 853 exclusive to DoT; use 443 for DoH.
If 853 is needed, configure DnsOverTlsPort instead.
Validate DoH ports against {53, 853}.

When it happens

Trigger: Assigning DnsServer.DnsOverHttpsPort = 853 via the settings API or config restore. The range and port-53 guards pass; this guard fires.

Common situations: Picking 853 for DoH believing it is a generic encrypted-DNS port. Colliding DoH and DoT configs during migration. Note this mirrors the DnsOverHttpPort 853 guard (311).

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/978c020f10c330e9. Report an issue: GitHub.