Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe error means another process already owns the DNS socket your program is trying to bind. Port 53 can be occupied on UDP, TCP, a specific local address, or every address through a wildcard bind. Find the owner first, then decide which resolver should remain in control.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “port 53 in use” actually means
DNS servers normally listen on port 53. A daemon such as dnsmasq, Unbound, BIND, or a containerized forwarder must create a socket on an address and port before it can answer queries. If that address-and-port combination is already owned, the operating system rejects the second bind and the daemon reports an error such as failed to create listening socket for port 53: Address already in use.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
This is a socket ownership conflict, not a bad DNS record. It does not indicate that a domain name is invalid or that upstream DNS is unavailable. The immediate problem is local: two services are requesting an overlapping listener.
Port 53 includes both UDP and TCP
Most ordinary DNS queries begin over UDP, but DNS also uses TCP. Large responses, zone transfers, DNSSEC-related exchanges, and fallback behavior can require TCP. Check both protocols before deciding that a service is free to start. A process listening on UDP 53 does not automatically own TCP 53, and vice versa.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The address matters as much as the port
A listener on 127.0.0.53:53 is narrower than one on 0.0.0.0:53. The latter is a wildcard IPv4 bind that can cover every local IPv4 interface. Consequently, a wildcard listener can conflict with a daemon that appears to use a different local address. The IPv6 equivalent is commonly shown as [::]:53.
Only one intended service should own each overlapping address, protocol, and port combination. Do not stop a process merely because its name looks unfamiliar; identify its systemd unit, container, or launch configuration first.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Find the process that owns port 53
Run both commands with administrative privileges so the output includes process details:
sudo ss -ltnup 'sport = :53'
sudo lsof -nP -iUDP:53 -iTCP:53Read the ss output
The -l option limits results to listening sockets, -t includes TCP, -u includes UDP, and -n keeps addresses and ports numeric. The process section normally includes a name and PID, for example a dnsmasq process or a systemd-resolved process. Record all rows, including separate IPv4 and IPv6 listeners.
Pay attention to the local address. A row for 127.0.0.53:53 indicates a loopback stub; 0.0.0.0:53 indicates a wildcard IPv4 listener; and [::]:53 indicates a wildcard IPv6 listener. The combination of protocol and address tells you which proposed bind is actually colliding.
Use lsof when the owner is easier to see there
lsof prints the command, PID, user, protocol, and endpoint in a compact form. The command above deliberately asks for UDP and TCP together. If one command shows a socket but not a useful service name, use its PID with systemd inspection rather than killing the PID directly.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Map the PID to a service
For a suspected systemd service, substitute its unit name in:
systemctl status <service>
systemctl cat <service>systemctl status shows whether the unit is active, its main PID, recent log lines, and dependencies. systemctl cat displays the unit files and drop-ins that determine how it starts. This distinction matters when two units launch similar daemons or when a package has enabled a second instance.
If the PID belongs to a container runtime, inspect which container publishes host port 53. A container can bind the host port even when no ordinary host service appears to be configured for DNS. The correct remedy is usually in the container’s published-port or host-bind setting.
The common systemd-resolved and dnsmasq conflict
On many Linux installations, systemd-resolved provides a local DNS stub. Its documented stub addresses are 127.0.0.53 and 127.0.0.54, and it can listen on both UDP and TCP port 53. Starting dnsmasq with a broad bind can therefore fail even though dnsmasq is not trying to use the same loopback address explicitly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Debian systemd-resolved manual describes the relevant behavior: “Note that the DNS stub listener is turned off implicitly when its listening address and port are already in use.” In practice, an administrator should still determine which resolver is intended rather than relying on an accidental bind failure to choose one.
Decide which resolver should be authoritative on this machine
Keep the systemd-resolved stub when local applications, NetworkManager integration, split DNS, VPN-specific domains, or the distribution’s resolver workflow depend on it. Choose dnsmasq, Unbound, BIND, or another daemon as the local authority when that service is deliberately configured to provide forwarding, caching, DHCP-linked names, authoritative zones, or another feature systemd-resolved is not intended to supply.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Do not run two general-purpose local resolvers on the same addresses simply because both installed successfully. If both are needed, assign explicit, non-overlapping addresses and make every client use the intended one.
Disable the systemd-resolved stub for dnsmasq
Only follow these steps after confirming that dnsmasq is configured and that the host will still have a usable resolver:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Create a systemd-resolved drop-in directory if it does not exist:
sudo mkdir -p /etc/systemd/resolved.conf.d. - Create
/etc/systemd/resolved.conf.d/stub-listener.confwith exactly:
[Resolve]
DNSStubListener=no- Restart the services in a controlled order:
sudo systemctl restart systemd-resolved
sudo systemctl restart dnsmasq- Inspect ownership again:
sudo ss -ltnup 'sport = :53'The expected result is that the intended daemon owns the address and protocols it was configured to use, while the systemd-resolved stub no longer occupies its former listener.
Check /etc/resolv.conf before and after the change
On distributions managed by systemd-resolved, /etc/resolv.conf is often a symbolic link to a resolver-managed file. Inspect it and review the resolver configuration after changing the stub:
ls -l /etc/resolv.conf
cat /etc/resolv.confDo not blindly replace the file with a hand-written nameserver entry. Distribution packaging and NetworkManager integration differ, and an incorrect replacement can break DHCP updates, VPN DNS, or boot-time recovery. Ensure that the nameserver address in use by applications is reachable on the service you chose.
Other processes that commonly occupy port 53
An existing dnsmasq instance
A second dnsmasq process can arise from a package service, a NetworkManager-managed instance, a virtualization stack, or a manually launched copy. Use the PID from ss or lsof, then inspect its unit and command line. Stop or disable only the duplicate after confirming which instance owns required DHCP or DNS settings. Removing the wrong instance can disconnect clients from both address assignment and name resolution.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Unbound, BIND, or another full resolver
Unbound and BIND (often called named) may intentionally provide the machine’s recursive or authoritative DNS service. If one is already configured, keep it and configure the new program as a client, forwarder, or listener on a different local address if that design is supported. DNS clients must query the address and port you select; changing a daemon’s bind setting without changing clients leaves them pointed at the wrong service.
A container or virtual machine publishing port 53
Container runtimes can publish UDP 53, TCP 53, or both from the host. Change the published host port, restrict the host bind address, or stop the container before restarting the host resolver. If the container needs to answer normal LAN DNS traffic, moving it to an arbitrary port may not be useful because ordinary clients expect port 53; an explicit, non-overlapping host address is usually the cleaner design.
A wildcard listener hiding an address collision
If output shows 0.0.0.0:53 or [::]:53, assume it can conflict with a listener requested on a specific interface. Prefer explicit bind addresses when the software supports them. For example, one service could be restricted to a LAN interface while another remains on loopback, provided the operating system’s IPv4 and IPv6 behavior and the clients’ resolver addresses are accounted for.
Choose the design before changing configuration
| Design | DNS or DHCP provider | Addresses exposed | What to check |
|---|---|---|---|
| Keep systemd-resolved | systemd-resolved handles the local stub and integrates with the host’s network configuration. | Typically the documented loopback stub addresses, including 127.0.0.53:53 and 127.0.0.54:53. |
Leave the stub enabled, configure the other daemon not to claim those addresses, and verify that /etc/resolv.conf points to the intended stub. |
| Replace the stub with a dedicated resolver | dnsmasq, Unbound, BIND, or another selected daemon provides forwarding, caching, DHCP-linked names, or authoritative answers. | Only the addresses explicitly configured for that daemon; LAN exposure should be intentional. | Disable the systemd-resolved stub with a drop-in, configure client resolver addresses, and test both local and ordinary lookups. |
| Run separate services on separate addresses | Each service has a defined role, such as loopback-only caching and LAN-facing DHCP/DNS. | Non-overlapping interface addresses; both services may still need UDP and TCP. | Confirm every client uses the right address and that wildcard binds do not overlap the design. |
The correct choice depends on whether the machine needs systemd-resolved’s network integration, whether another daemon supplies DHCP, which addresses must be reachable by LAN clients, and whether both UDP and TCP are required by the selected service.
A safe fix workflow
- Capture the failure and current state. Do not repeatedly restart services before identifying the owner. Run
sudo ss -ltnup 'sport = :53'and thelsofcommand. - Identify the owner. Map each PID to a systemd unit, container, virtual machine, or manually launched command. Use
systemctl status <service>andsystemctl cat <service>where applicable. - Choose one authoritative local design. Decide whether systemd-resolved, the new daemon, or deliberately separated services should answer each class of query.
- Change one setting. Examples include disabling the systemd-resolved stub, narrowing a daemon’s bind address, changing a container’s host bind, or removing an accidental duplicate unit. Avoid simultaneous edits to several resolver components.
- Restart the affected units. Restart the service whose configuration changed and the intended replacement only when necessary. Record errors immediately if a restart fails.
- Recheck sockets. Run the
sscommand again and confirm that the expected owner, protocol, and address are present. - Test the daemon directly. Query its actual listening address with
digbefore testing applications that may use cached settings. - Test normal host resolution. Use
getent hosts example.comto verify the resolver path used by ordinary applications. - Check boot persistence. Make sure the intended unit is enabled, no failed unit remains, and the configuration survives a reboot.
Verification commands and expected results
Check for failed units
systemctl --failedThe DNS service you intend to run should not appear in the failed-unit list. A clean restart is not enough if another dependent unit remains failed or if a duplicate service returns at the next boot.
Read current-boot logs
journalctl -u <service> -bLook for bind errors, permission failures, malformed configuration, and messages showing which addresses the daemon attempted to open. A port conflict that has been corrected may be followed by a separate configuration error, so verify the complete startup sequence.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Query the selected resolver directly
If the systemd-resolved stub remains enabled, test it with:
dig @127.0.0.53 example.comAfter replacing the stub, query the replacement daemon’s configured address instead:
dig @<replacement-address> example.comReplace the angle-bracket value with the real address; do not type the brackets. A successful direct query proves that the daemon answers on that endpoint, but it does not prove that applications are using it.
Test the normal application path
getent hosts example.comThis uses the host’s configured name-service path. If direct dig succeeds but getent fails, inspect /etc/resolv.conf, network-manager settings, VPN configuration, and any local resolver integration rather than changing DNS records.
When the error returns after a reboot
A recurring conflict usually means two units are enabled, a container starts before the host resolver, or a package recreates a configuration file. Review enabled services and the unit dependencies shown by systemctl status. Check container startup definitions for published UDP and TCP port 53. Ensure that only the intended service is enabled to claim each address.
Configuration persistence also matters. A temporary command-line bind change will disappear when the daemon restarts, while a drop-in under /etc/systemd/resolved.conf.d/ is designed to persist. Keep a record of the chosen listener addresses and the resolver address referenced by /etc/resolv.conf, then verify them after a reboot.
Rollback if DNS stops working
If disabling the stub or changing a bind address leaves the host without name resolution, restore the previous configuration and restart the original service. For the systemd-resolved change, remove or rename the drop-in, restart systemd-resolved, and confirm its listener with ss. Then inspect /etc/resolv.conf and restore the distribution-managed arrangement if it was altered.
If the replacement daemon is the problem, stop it only after ensuring that systemd-resolved or another known-good resolver is available. Test with dig against the restored listener and then with getent. This staged rollback avoids turning a single port conflict into a complete loss of host and network name resolution.
Common mistakes to avoid
- Killing a PID without identifying its service: the process may provide DHCP, VPN DNS, or another required function and may immediately restart.
- Checking UDP only: TCP 53 can remain occupied and cause the next startup attempt to fail.
- Ignoring wildcard binds:
0.0.0.0:53and[::]:53can overlap a specific-interface design. - Disabling systemd-resolved without a replacement path: applications may continue using a stale or invalid
/etc/resolv.conf. - Overwriting
/etc/resolv.confblindly: package and network-management conventions differ between distributions. - Assuming a successful restart proves the fix: verify socket ownership and perform both direct and normal resolver queries.
Bottom line
“Failed to create socket on UDP port 53: port in use” means the requested DNS listener overlaps an existing socket. Inspect UDP and TCP ownership with ss and lsof, map the PID to its service, choose which resolver should own each address, change one configuration, and verify the result with socket checks, dig, getent, and current-boot logs. For the common systemd-resolved versus dnsmasq case, disable the resolved stub only after confirming the replacement resolver and the host’s /etc/resolv.conf path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
