{"record":{"id":"dda46eafdc013f89","repo":"TechnitiumSoftware/DnsServer","slug":"port-853-is-reserved-for-dns-over-tls-service-ple-dda46e","errorCode":null,"errorMessage":"Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTP service.","messagePattern":"Port 853 is reserved for DNS-over-TLS service\\. Please use a different port for DNS-over-HTTP service\\.","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":7735,"sourceCode":"                    throw new ArgumentOutOfRangeException(nameof(DnsOverTcpProxyPort), \"Port number valid range is from 0 to 65535.\");\n\n                _dnsOverTcpProxyPort = value;\n            }\n        }\n\n        public int DnsOverHttpPort\n        {\n            get { return _dnsOverHttpPort; }\n            set\n            {\n                if ((value < ushort.MinValue) || (value > ushort.MaxValue))\n                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), \"Port number valid range is from 0 to 65535.\");\n\n                if (value == 53)\n                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), \"Port 53 cannot be used for DNS-over-HTTP service. Please use a different port.\");\n\n                if (value == 853)\n                    throw new ArgumentOutOfRangeException(nameof(DnsOverHttpPort), \"Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS-over-HTTP service.\");\n\n                _dnsOverHttpPort = value;\n            }\n        }\n\n        public string DnsOverHttpUnixSocket\n        {\n            get { return _dnsOverHttpUnixSocket; }\n            set\n            {\n                if (string.IsNullOrWhiteSpace(value))\n                    value = null;\n\n                _dnsOverHttpUnixSocket = value;\n            }\n        }\n\n        public string DnsOverHttpsUnixSocket","sourceCodeStart":7717,"sourceCodeEnd":7753,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L7717-L7753","documentation":"Thrown by the DnsOverHttpPort setter when value == 853 (the third and last guard). Port 853 is reserved for DNS-over-TLS (DoT); the server prevents DNS-over-HTTP from binding it so the two encrypted transports do not collide. The error explicitly tells you 853 is for DoT.","triggerScenarios":"Assigning DnsServer.DnsOverHttpPort = 853 through the settings API or config restore. The range guard (309) and the port-53 guard (310) both pass, then this fires.","commonSituations":"Reusing 853 for DoH by mistake because it 'looks like an encrypted DNS port'. Migrating a config where DoT and DoH ports collided. Picking 853 believing it is a generic secure-DNS port.","solutions":["Use a non-reserved port for DoH (e.g. 8053, 443); keep 853 for DoT only.","If you want encrypted DNS on 853, enable DNS-over-Tls and set DnsOverTlsPort accordingly instead.","Pre-validate that the DoH port is neither 53 nor 853 before assigning.","Re-submit the corrected port via the settings API."],"exampleFix":"// before\n_dnsServer.DnsOverHttpPort = 853;  // throws: 853 reserved for DoT\n\n// after\n_dnsServer.DnsOverHttpPort = 443;   // DoH on 443; DoT stays on 853","handlingStrategy":"validation","validationCode":"if (parsed == 853) parsed = 443; // 853 reserved for DoT\n_dnsServer.DnsOverHttpPort = parsed;","typeGuard":"static bool IsAcceptableDohPort(int value) => value != 53 && value != 853 && value >= 0 && value <= 65535;","tryCatchPattern":"try { _dnsServer.DnsOverHttpPort = parsed; }\ncatch (ArgumentOutOfRangeException ex) when (ex.ParamName == nameof(DnsServer.DnsOverHttpPort) && parsed == 853)\n{ _dnsServer.DnsOverHttpPort = 443; }","preventionTips":["Keep 853 exclusive to DoT.","If 853 is required, configure DnsOverTlsPort instead.","Validate DoH ports against {53, 853} exclusions."],"tags":["dns","network","port","dnsoverhttp","reserved-port","configuration","argumentoutofrange"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}