Common Port Numbers: 22, 53, 80, 443 and the Rest

What a port is

A server can run a web server, a mail server and a database at the same time on one IP address. The port number tells the operating system which of them a packet is for. TCP and UDP, the two transport protocols most traffic uses, each have their own set of ports, and RFC 6335 says these are 16-bit numbers. That gives 65,536 values, from 0 to 65,535.

Every connection has two ends. The server listens on a fixed, known port such as 443, so clients know where to knock. The client's own end does not need a famous number; RFC 6335 sets aside a whole range of never-assigned ports, also called ephemeral ports, that software may use without any registration.

The ports you will meet

These entries come from the IANA Service Name and Transport Protocol Port Number Registry, with IANA's own service names and descriptions. The transport column lists what IANA registered, which is not always what the protocol uses in practice.

Some groups are worth knowing as sets. Web: 80 and 443, with 8080 registered as an HTTP alternate. Mail: 25 for SMTP, 587 and 465 for message submission, 143 and 993 for IMAP, 110 and 995 for POP3. The TLS versions sit on their own numbers: 993 for IMAP over TLS, 995 for POP3 over TLS, 853 for DNS over TLS. Databases: 3306 for MySQL, 5432 for PostgreSQL, 6379 for Redis, 27017 for MongoDB. A database port rarely needs to be open to the whole internet; in most setups only the application server talks to it.

The three ranges

RFC 6335 splits the 65,536 numbers into three ranges with different rules:

The System Ports are the smallest and most densely assigned range, so RFC 6335 sets stricter requirements for new assignments there: only through IETF Review or IESG Approval, with a case for why a higher port will not do. The User Ports are where most new applications are registered. The Dynamic Ports are never assigned. The RFC says software may use any free one on the local host, but must not assume a specific one will always be available, and must not use one as a service identifier.

Port 0 is listed in the registry as reserved, on both TCP and UDP.

Ports in URLs

A URL can name a port after the host, as in https://example.com:8443/. RFC 9110 makes 80 the default for http and 443 for https, so https://example.com/ and https://example.com:443/ are the same address. Any other port has to be written out.

A non-default port changes more than the address. Google's robots.txt documentation says rules apply only to the host, protocol and port where the file is served. The standard ports 80 and 443 count as the plain host name, but a robots.txt on a non-standard port covers only content on that port. Browsers draw a similar line: a different port is a different origin, which the CORS guide explains. A frontend on port 3000 calling an API on port 8080 on the same machine is a cross-origin request.

Reading a connection

Firewall logs, server dashboards and command-line tools show connections as address and port pairs. A line like this one, using address blocks that RFC 5737 reserves for documentation:

203.0.113.25:51734  →  198.51.100.7:443   TCP

reads as: a client at 203.0.113.25, using port 51734 on its side, talks to a server at 198.51.100.7 on port 443. The server port says what the client asked for, here HTTP over TLS by its registration. The client port, 51734, sits in the Dynamic range and says nothing about the service; the next connection from the same client will likely use a different one. When you look for what a machine offers, look at the ports it listens on, not at the high numbers on the other end.

The transport matters too. The registry lists 443 for HTTPS on both TCP and UDP, and RFC 1035 already defined DNS on port 53 over both UDP and TCP. A firewall rule that opens only TCP 53 lets some DNS traffic through and blocks the rest, so rules for these services are usually written for both transports. The What is my IP tool shows whether your own public address is IPv4 or IPv6, which decides how an address and port pair is written: RFC 3986 puts IPv6 addresses in square brackets before the port, as in [2001:db8::1]:443.

What a port number does not tell you

The registry records which service a port was assigned to, not what is actually running there. IANA says so in its own notes: traffic flowing to or from a registered port is not necessarily good traffic, nor does it necessarily belong to the assigned service. Anyone can run SSH on 443 or a web server on 22. IANA also says assigned ports should not be used without registration, but nothing technical stops it.

For a site owner, the useful checks are simple:

• Expose only what you need. A typical web server needs 443, plus 80 to redirect to it. SSH should be limited to known addresses.
• Check what is reachable. Know your public address first; What is my IP shows the one the internet sees.
• Check the certificate on 443. The SSL checker shows a site's certificate: issuer, expiry date, days left and the chain. The HTTP vs HTTPS guide explains what TLS on that port protects.
• Plan address ranges together with ports. Firewall rules combine both; the subnet calculator turns a CIDR block such as /24 into its network, broadcast and host range.

DNS on 53 and 853

DNS is a good example of one service on several numbers. The registry lists port 53 as the Domain Name Server port on both TCP and UDP, and 853 as domain-s: DNS over TLS on TCP, and over DTLS or QUIC on UDP. The guide to domains, DNS and hosting covers what those queries look up, and mail authentication records are in the SPF, DKIM and DMARC guide.

Frequently asked questions

Sources

• IANA: Service Name and Transport Protocol Port Number Registry (service names, transport protocols and descriptions for every port in the table; port 0 reserved; the note that a registered port does not imply the traffic is that service; assigned ports should not be used without registration)
• RFC 6335, section 6 (16-bit port numbers; System Ports 0 to 1023, User Ports 1024 to 49151, Dynamic Ports 49152 to 65535, never assigned) and section 8.1.2 (dynamic ports must not be used as service identifiers; stricter rules for System Ports)
• RFC 9110, HTTP Semantics, sections 4.2.1 and 4.2.2 (TCP port 80 is the default for http and 443 for https when the URI has no port)
• RFC 1035, Domain names, section 4.2 (DNS messages over UDP and over TCP, both on server port 53)
• RFC 5737 and RFC 3849 (198.51.100.0/24, 203.0.113.0/24 and 2001:db8::/32 are reserved for documentation)
• RFC 3986, URI Generic Syntax, section 3.2.2 (an IPv6 address in a URI is enclosed in square brackets)
• Google Search Central: robots.txt specification (rules apply per host, protocol and port; 80 for http and 443 for https are equivalent to the default host names; files on non-standard ports apply only to those ports)

Written by Tobias. Updated October 30, 2026.