{"record":{"id":"fa2a6329f3995777","repo":"TechnitiumSoftware/DnsServer","slug":"port-853-is-reserved-for-dns-over-tls-service-ple","errorCode":null,"errorMessage":"Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS Server Local End Points.","messagePattern":"Port 853 is reserved for DNS-over-TLS service\\. Please use a different port for DNS Server Local End Points\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":7140,"sourceCode":"\n        public string ConfigFolder\n        { get { return _configFolder; } }\n\n        public IReadOnlyList<IPEndPoint> LocalEndPoints\n        {\n            get { return _localEndPoints; }\n            set\n            {\n                if ((value is null) || (value.Count == 0))\n                {\n                    _localEndPoints = [new IPEndPoint(IPAddress.Any, 53), new IPEndPoint(IPAddress.IPv6Any, 53)];\n                }\n                else\n                {\n                    foreach (IPEndPoint ep in value)\n                    {\n                        if (ep.Port == 853)\n                            throw new ArgumentException(\"Port 853 is reserved for DNS-over-TLS service. Please use a different port for DNS Server Local End Points.\", nameof(LocalEndPoints));\n                    }\n\n                    _localEndPoints = value;\n                }\n            }\n        }\n\n        public LogManager LogManager\n        { get { return _log; } }\n\n        internal MailAddress DefaultResponsiblePerson\n        {\n            get { return _defaultResponsiblePerson; }\n            set { _defaultResponsiblePerson = value; }\n        }\n\n        public MailAddress ResponsiblePerson\n        {","sourceCodeStart":7122,"sourceCodeEnd":7158,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L7122-L7158","documentation":"Thrown by the LocalEndPoints property setter when any IPEndPoint in the collection uses port 853. Port 853 is reserved for DNS-over-TLS (DoT) which the server runs independently, so binding a plain DNS listener on it would conflict. The check iterates every endpoint before assigning the collection.","triggerScenarios":"Setting server.LocalEndPoints to a list containing an IPEndPoint with port 853, e.g. new IPEndPoint(IPAddress.Any, 853). Also triggered when loading a saved config file that lists port 853 as a local endpoint.","commonSituations":"Configuring DNS server listeners from a settings file where 853 was mistakenly included; copy-pasting DoT port into the plain-DNS endpoint list; importing config from another DNS server that used 853 for standard DNS.","solutions":["Remove or change any endpoint using port 853 before assigning LocalEndPoints — use 53 for DNS, or a custom non-reserved port.","If you intend to run DNS-over-TLS, configure it separately via the DoT settings, not LocalEndPoints.","Filter the list programmatically before assignment to strip port 853 entries."],"exampleFix":"// before\nserver.LocalEndPoints = new List<IPEndPoint>\n{\n    new IPEndPoint(IPAddress.Any, 53),\n    new IPEndPoint(IPAddress.Any, 853) // throws\n};\n\n// after\nserver.LocalEndPoints = new List<IPEndPoint>\n{\n    new IPEndPoint(IPAddress.Any, 53)\n};","handlingStrategy":"validation","validationCode":"var cleaned = endpoints\n    .Where(ep => ep.Port != 853)\n    .ToList();\nserver.LocalEndPoints = cleaned.Count > 0\n    ? cleaned\n    : new List<IPEndPoint> { new(IPAddress.Any, 53) };","typeGuard":"static bool IsValidLocalEndPoint(IPEndPoint ep) => ep.Port != 853 && ep.Port > 0 && ep.Port <= 65535;","tryCatchPattern":"try { server.LocalEndPoints = endpoints; }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"853\"))\n{\n    endpoints = endpoints.Where(ep => ep.Port != 853).ToList();\n    server.LocalEndPoints = endpoints;\n}","preventionTips":["Validate endpoint ports against reserved ports (853 for DoT, 5353 for mDNS) before assignment.","Centralize listener configuration in a single builder method that enforces port rules."],"tags":["dns","port-conflict","dns-over-tls","configuration"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}