How to bind to port 53 when using 'named -u bind' with FreeBSD
  • 22 Mar 2022
  • 1 Minute to read
  • Contributors
  • Dark
  • PDF

How to bind to port 53 when using 'named -u bind' with FreeBSD

  • Dark
  • PDF

Article summary

Normally binding to a reserved port on FreeBSD requires the process to be be running as root. For most uses this is not a problem as named binds to port 53 before changing user id; however, if you are running in a environment where interface addresses are changing this can be a issue. FreeBSD has a kernel module, mac-portacl, that will allow a non-privileged user to bind to specified ports.

Assuming that the user bind has user id 53, adding the following configuration elements and rebooting will allow named, running as bind, to bind to the reserved port 53.


Note - apply carefully
Getting this wrong may lock you out of the system if you are accessing it across the network!

When using DNS over TLS, add port number 853 to the rules. When using DNS over HTTPS, add port number 443 to the rules. Below are the configuration rules when using all three ports:


More information about mac-portacl can be found here: