TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Port 853 is reserved for DNS-over-TLS service. Please use a

Error message

Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTP service.

What it means

Thrown by the DnsOverHttpPort setter when value == 853 (the third and last guard). Port 853 is reserved for DNS-over-TLS (DoT); the server prevents DNS-over-HTTP from binding it so the two encrypted transports do not collide. The error explicitly tells you 853 is for DoT.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7735

                    throw new ArgumentOutOfRangeException(nameof(DnsOverTcpProxyPort), "Port number valid range is from 0 to 65535.");

                _dnsOverTcpProxyPort = value;
            }
        }

        public int DnsOverHttpPort
        {
            get { return _dnsOverHttpPort; }
            set
            {
                if ((value < ushort.MinValue) || (value > ushort.MaxValue))
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), "Port number valid range is from 0 to 65535.");

                if (value == 53)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), "Port 53 cannot be used for DNS-over-HTTP service. Please use a different port.");

                if (value == 853)
                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), "Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTP service.");

                _dnsOverHttpPort = value;
            }
        }

        public string DnsOverHttpUnixSocket
        {
            get { return _dnsOverHttpUnixSocket; }
            set
            {
                if (string.IsNullOrWhiteSpace(value))
                    value = null;

                _dnsOverHttpUnixSocket = value;
            }
        }

        public string DnsOverHttpsUnixSocket

View on GitHub (pinned to d0484b6c1e)

Solutions

Use a non-reserved port for DoH (e.g. 8053, 443); keep 853 for DoT only.
If you want encrypted DNS on 853, enable DNS-over-Tls and set DnsOverTlsPort accordingly instead.
Pre-validate that the DoH port is neither 53 nor 853 before assigning.
Re-submit the corrected port via the settings API.

Example fix

// before
_dnsServer.DnsOverHttpPort = 853;  // throws: 853 reserved for DoT

// after
_dnsServer.DnsOverHttpPort = 443;   // DoH on 443; DoT stays on 853

Defensive patterns

Strategy: validation

Validate before calling

if (parsed == 853) parsed = 443; // 853 reserved for DoT
_dnsServer.DnsOverHttpPort = parsed;

Type guard

static bool IsAcceptableDohPort(int value) => value != 53 && value != 853 && value >= 0 && value <= 65535;

Try / catch

try { _dnsServer.DnsOverHttpPort = parsed; }
catch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(DnsServer.DnsOverHttpPort) && parsed == 853)
{ _dnsServer.DnsOverHttpPort = 443; }

Prevention

Keep 853 exclusive to DoT.
If 853 is required, configure DnsOverTlsPort instead.
Validate DoH ports against {53, 853} exclusions.

When it happens

Trigger: Assigning DnsServer.DnsOverHttpPort = 853 through the settings API or config restore. The range guard (309) and the port-53 guard (310) both pass, then this fires.

Common situations: Reusing 853 for DoH by mistake because it 'looks like an encrypted DNS port'. Migrating a config where DoT and DoH ports collided. Picking 853 believing it is a generic secure-DNS port.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/dda46eafdc013f89. Report an issue: GitHub.