port 53
Port 53, defined by RFC 1035, is the only well-known port officially reserved for two transport protocols at once, UDP and TCP, and the reason is an old size limit.
The protocol shows as TCP/UDP because port 53 is one of the few catalog entries with both transports in the same record, and security shows "varies" because the query itself does not encrypt.
This is the behavior mandated by RFC 1035 when the response exceeds the size negotiated in the UDP packet.
The port 53 catalog entry lists 853 as its secure alternative for exactly this reason.
Deliberate decision: unauthorized port scanning is an abuse vector and has legal implications in several countries. We prefer a clear, safe reference.
Because UDP has no handshake or congestion control, so a simple name query becomes just one packet out and one back. For billions of queries per second on public resolvers, that lower overhead matters more than the extra reliability TCP would add.
No, not for a production DNS server: blocking TCP/53 breaks zone transfers (AXFR) and breaks resolution of any answer that needs truncation and retry, including DNSSEC-signed responses.
Both encrypt the DNS query, but DoT uses the dedicated port 853, easy for a corporate network to identify and block, while DoH uses port 443 and blends into regular HTTPS traffic, making selective blocking harder.
Name resolution. UDP for normal queries, TCP for zone transfers and large answers. DoT (853) and DoH (443) encrypt.
Everything runs locally in your browser from an embedded catalog. This tool does not connect to IPs or ports, it is not a scanner.