TechnitiumSoftware/DnsServer · error · ArgumentException

Port 853 is reserved for DNS-over-TLS service. Please use a

Error message

Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS Server Local End Points.

What it means

Thrown by the LocalEndPoints property setter when any IPEndPoint in the collection uses port 853. Port 853 is reserved for DNS-over-TLS (DoT) which the server runs independently, so binding a plain DNS listener on it would conflict. The check iterates every endpoint before assigning the collection.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:7140

        public string ConfigFolder
        { get { return _configFolder; } }

        public IReadOnlyList<IPEndPoint> LocalEndPoints
        {
            get { return _localEndPoints; }
            set
            {
                if ((value is null) || (value.Count == 0))
                {
                    _localEndPoints = [new IPEndPoint(IPAddress.Any, 53), new IPEndPoint(IPAddress.IPv6Any, 53)];
                }
                else
                {
                    foreach (IPEndPoint ep in value)
                    {
                        if (ep.Port == 853)
                            throw new ArgumentException("Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS Server Local End Points.", nameof(LocalEndPoints));
                    }

                    _localEndPoints = value;
                }
            }
        }

        public LogManager LogManager
        { get { return _log; } }

        internal MailAddress DefaultResponsiblePerson
        {
            get { return _defaultResponsiblePerson; }
            set { _defaultResponsiblePerson = value; }
        }

        public MailAddress ResponsiblePerson
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

Remove or change any endpoint using port 853 before assigning LocalEndPoints — use 53 for DNS, or a custom non-reserved port.
If you intend to run DNS-over-TLS, configure it separately via the DoT settings, not LocalEndPoints.
Filter the list programmatically before assignment to strip port 853 entries.

Example fix

// before
server.LocalEndPoints = new List<IPEndPoint>
{
    new IPEndPoint(IPAddress.Any, 53),
    new IPEndPoint(IPAddress.Any, 853) // throws
};

// after
server.LocalEndPoints = new List<IPEndPoint>
{
    new IPEndPoint(IPAddress.Any, 53)
};

Defensive patterns

Strategy: validation

Validate before calling

var cleaned = endpoints
    .Where(ep => ep.Port != 853)
    .ToList();
server.LocalEndPoints = cleaned.Count > 0
    ? cleaned
    : new List<IPEndPoint> { new(IPAddress.Any, 53) };

Type guard

static bool IsValidLocalEndPoint(IPEndPoint ep) => ep.Port != 853 && ep.Port > 0 && ep.Port <= 65535;

Try / catch

try { server.LocalEndPoints = endpoints; }
catch (ArgumentException ex) when (ex.Message.Contains("853"))
{
    endpoints = endpoints.Where(ep => ep.Port != 853).ToList();
    server.LocalEndPoints = endpoints;
}

Prevention

Validate endpoint ports against reserved ports (853 for DoT, 5353 for mDNS) before assignment.
Centralize listener configuration in a single builder method that enforces port rules.

When it happens

Trigger: Setting server.LocalEndPoints to a list containing an IPEndPoint with port 853, e.g. new IPEndPoint(IPAddress.Any, 853). Also triggered when loading a saved config file that lists port 853 as a local endpoint.

Common situations: Configuring DNS server listeners from a settings file where 853 was mistakenly included; copy-pasting DoT port into the plain-DNS endpoint list; importing config from another DNS server that used 853 for standard DNS.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/fa2a6329f3995777. Report an issue: GitHub.