What it is
Domain name resolution (53/tcp·udp).
Why it is risky
Open resolvers are abused for amplification DDoS, and exposed zone transfers (AXFR) reveal internal structure.
What to do
Separate authoritative/recursive servers, limit recursion to internal networks, and block AXFR.
Is it listening on your server?
Linux
ss -ltnp 'sport = :53'Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.