iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The error means another process already owns the DNS socket your program is trying to bind. Identify that process first, then decide which resolver should provide DNS on this machine. Do not kill a process or disable a service until you know what depends on it.
What the error means
DNS servers normally listen on port 53. A daemon such as dnsmasq, Unbound, BIND (named), or a containerized forwarder must create a socket on a local address and port before it can answer queries. “Failed to create socket on UDP port 53: Port in use” means the requested address-and-port combination is already occupied. It is a socket ownership conflict, not a bad DNS record or an upstream Internet failure.
Recommended Free Tools
Port 53 can be used independently by UDP and TCP. Most ordinary DNS queries use UDP, while TCP is required for some large responses, DNSSEC exchanges, and zone transfers. A service may therefore fail even when you checked only one protocol. Also check whether a process is bound to a wildcard address such as 0.0.0.0:53 or [::]:53. A wildcard listener can overlap a daemon that is trying to bind one specific interface address.
Find the process that owns port 53
Run both socket queries as root so the process and PID columns are visible:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
sudo ss -ltnup 'sport = :53'
sudo lsof -nP -iUDP:53 -iTCP:53The ss command lists listening TCP and UDP sockets. Look for the local address, protocol, process name, and PID. The lsof command provides a second view and can reveal a process that is not obvious in the first output.
- 127.0.0.53:53 or 127.0.0.54:53: commonly the local stub listener from systemd-resolved.
- 0.0.0.0:53 or [::]:53: a wildcard listener accepting connections on every applicable local interface.
- A LAN address such as 192.168.1.10:53: a daemon bound to one interface; it can still conflict with a wildcard listener.
- Two entries for the same service: possibly separate UDP and TCP sockets, which is normal, or two instances of the daemon, which is not.
Map the PID to its service unit before stopping anything:
systemctl status <service>
systemctl cat <service>Replace <service> with the unit name shown by ss or found from the process details. systemctl status shows whether the unit is active and its recent log output. systemctl cat shows the unit definition, including the executable and any drop-ins, so you can distinguish the intended resolver from a duplicate or helper process.
Common programs that occupy DNS port 53
systemd-resolved
On many Linux distributions, systemd-resolved provides a local DNS stub at 127.0.0.53 and 127.0.0.54 on both UDP and TCP port 53. Local applications commonly reach it through the resolver configuration managed by the distribution. Its listener is controlled by the DNSStubListener setting.
dnsmasq
dnsmasq can provide DNS forwarding, caching, and DHCP. A second dnsmasq instance, a package-started service, or systemd-resolved can prevent a new dnsmasq process from binding. Check the service unit and its configured interface or listen address rather than assuming every dnsmasq process is interchangeable.
Unbound or BIND
Unbound and BIND (usually named) are full DNS resolvers. If either is already the authoritative local resolver, replacing it with another daemon requires a deliberate migration of clients and configuration. Stopping it may break name resolution for the host or an entire network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Containers and duplicate launches
A container can publish its internal port 53 onto the host. The host then sees that published address as occupied even though the DNS process runs inside the container. A manually launched daemon can also duplicate a systemd-managed instance. Identify the owning unit, container, or command line before changing the host service.
Choose which resolver should own the address
Only one intended service should own each requested address-and-port combination. Decide which design matches the machine:
| Design | Who answers DNS | Important checks |
|---|---|---|
| Keep systemd-resolved | The systemd stub on its configured local addresses | Other daemons must use a different address or port; applications and /etc/resolv.conf must continue to use the stub. |
| Use dnsmasq, Unbound, or BIND as the host resolver | The replacement daemon on port 53 | Disable or relocate the conflicting stub, configure forwarding or authoritative zones, and point clients at the replacement address. |
| Run a containerized resolver | The container’s published host address and port | Change the host bind address or published port if another host service must remain on 53. |
| Run two DNS services | Each service uses a non-overlapping local address or port | Both programs must support explicit bind settings, and every client must query the correct address and port. |
Consider whether the service also provides DHCP, whether local programs rely on systemd-resolved integration, which addresses are exposed to the LAN, how /etc/resolv.conf is managed, and whether the arrangement survives a reboot. A successful start is not enough if clients still query the old resolver.
Fix the usual systemd-resolved and dnsmasq conflict
If the listener is systemd-resolved and dnsmasq is the resolver you actually want on port 53, disable only the resolved stub listener. The Debian resolved.conf(5) documentation notes: “Note that the DNS stub listener is turned off implicitly when its listening address and port are already in use.” Explicit configuration is clearer and survives service restarts.
1. Confirm the conflict
sudo ss -ltnup 'sport = :53'
systemctl status systemd-resolved
systemctl status dnsmasqMake sure systemd-resolved owns the address that dnsmasq is trying to use. If another service or container owns port 53, use that service’s configuration instead.
2. Create a resolved drop-in
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo sh -c 'cat > /etc/systemd/resolved.conf.d/stub-listener.conf <<"EOF"
[Resolve]
DNSStubListener=no
EOF'The drop-in changes the stub setting without editing the package-maintained main configuration file. If your distribution uses a different configuration layout, use its documented drop-in location while retaining the same [Resolve] setting.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
3. Restart the intended services
sudo systemctl restart systemd-resolved
sudo systemctl restart dnsmasqRestarting resolved applies the listener change; restarting dnsmasq makes it retry its bind. If dnsmasq still fails, inspect its unit and logs because another address, port, or configuration error may be involved.
4. Check ownership and service health
sudo ss -ltnup 'sport = :53'
systemctl --failed
journalctl -u dnsmasq -b
journalctl -u systemd-resolved -bThe socket listing should now show dnsmasq on the intended address, and the failed-unit list should not contain the DNS service. The boot-scoped journal commands help distinguish a bind failure from a syntax, permission, or upstream-configuration problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
Protect the host’s resolver configuration
Before disabling the stub, verify how the host obtains nameserver information:
ls -l /etc/resolv.conf
cat /etc/resolv.confOn systems integrated with systemd-resolved, /etc/resolv.conf is often a symbolic link to a file generated by resolved. Other distributions manage it through NetworkManager, another resolver manager, or a static file. Do not blindly overwrite it. After moving DNS ownership, ensure that the file points to an address where the replacement daemon actually listens, or that the network manager is configured to install the correct nameserver.
Changing the listening service without changing the client path can produce a misleading result: the daemon starts successfully, but command-line tools and applications continue querying an old or unreachable address. Treat the socket owner and the client resolver configuration as one change.
Other ways to resolve the conflict
Keep the existing resolver and move the new daemon
If systemd-resolved, Unbound, BIND, or dnsmasq is the intended resolver, leave it on port 53 and configure the new program to bind a different local IP address or port, if that program supports it. For example, a daemon can listen only on a dedicated LAN address while the existing resolver remains on loopback. Clients must then be configured to query the selected address and, where applicable, nonstandard port. A DNS client that assumes port 53 will not automatically discover a service moved elsewhere.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Remove an accidental duplicate
If the PID belongs to a second copy of the same daemon, determine whether it was started manually, by a second unit, or by a supervisor. Stop the duplicate through its owner rather than killing the PID and allowing it to return at the next reboot:
systemctl status <duplicate-unit>
sudo systemctl stop <duplicate-unit>
sudo systemctl disable <duplicate-unit>Disable a unit only after confirming that it is the duplicate and checking its dependencies. A package update or a dependent service may expect the primary unit to remain enabled.
Change a container’s published port or address
If a container publishes host port 53, edit its port mapping to use a different host address or port, or stop the container if it is not needed. Then restart the host DNS service and re-run the ss query. Changing only the container’s internal port does not necessarily release the host port; the host-side publication is what matters.
Replace a wildcard bind with explicit addresses
A wildcard listener can block a more specific listener. When the software supports it, configure each service with explicit, non-overlapping addresses. For example, one service can use loopback while another uses a LAN interface. Confirm both IPv4 and IPv6 settings; an unused-looking [::]:53 listener can still account for a failure on an IPv6-capable system.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Verify DNS after the change
Use tests that check the socket, the selected resolver, and normal client behavior separately.
- Confirm the final sockets. Run
sudo ss -ltnup 'sport = :53'and verify that the intended process owns the expected UDP and TCP addresses. - Check service state. Run
systemctl --failedand inspectjournalctl -u <service> -bfor the current boot. - Query the resolver directly. If the systemd stub remains enabled, test it with
dig @127.0.0.53 example.com. After handing ownership to another daemon, query its actual address, such asdig @<replacement-address> example.com. - Test the normal resolver path. Run
getent hosts example.com. This exercises the system’s configured name-service path rather than bypassing it with a manually selected server. - Test from a client when the daemon serves a network. Query from an allowed LAN host and check that firewall rules, DHCP-provided DNS settings, and the advertised address all match the new design.
A direct dig response proves that one server answered; it does not prove that applications use that server. The getent check catches a stale /etc/resolv.conf, network-manager setting, or other client-side configuration.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Troubleshooting when the error remains
The command shows no owner
Run the commands with sudo and check both UDP and TCP. A short-lived process may exit between commands, or a service may be repeatedly starting and stopping. Use the relevant unit’s journal and inspect its configured listen address.
You stopped a service but port 53 returned
Another unit, socket activation, container supervisor, or restart policy may be bringing it back. Check the process’s service mapping with systemctl status, inspect dependencies with systemctl cat, and identify any container or orchestration configuration publishing port 53.
dnsmasq starts but clients have no Internet names
Check the daemon’s forwarding or upstream-DNS configuration, firewall rules, and the nameserver address installed for clients. Confirm the replacement service can answer a direct query, then verify /etc/resolv.conf and DHCP settings. A port conflict fix does not configure upstream resolution by itself.
The host resolves names only after a reboot failure
Check persistence: the resolved drop-in must be under /etc/systemd/resolved.conf.d, the intended service must be enabled if it should start automatically, and any container port mapping must be stored in its persistent definition. Repeat the socket and getent tests after reboot to catch ordering or regenerated resolver files.
Only TCP or only UDP appears
Do not assume the missing protocol is irrelevant. DNS commonly uses UDP but requires TCP in specific cases, and many resolvers intentionally open both. Configure and test both protocols on the selected address, and ensure firewall rules allow the traffic your clients need.
A safe decision sequence
- Record the exact local address, protocol, and PID reported for port 53.
- Map the PID to its systemd unit, container, or manually launched command.
- Decide which service should provide DNS, DHCP, forwarding, or authoritative answers on this host.
- Keep that service on the required address and port, or configure non-overlapping binds for a deliberate multi-service design.
- Change one configuration, restart the affected services, and inspect the sockets again.
- Verify the service logs, direct DNS response, and ordinary client resolution.
- Recheck the arrangement after reboot if the machine is expected to provide DNS continuously.
Following this order avoids the most damaging shortcut: disabling a working resolver before its replacement and client configuration are ready. The durable fix is not merely making a process start; it is ensuring that exactly the intended service answers on the address clients actually use.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
