Skip to main content

Pi-hole Moving Port 53

Free up port 53 (for Pi-hole Docker)

In Linux, you need to tell systemd-resolved not to listen on port 53 (via its stub listener), then restart it. This keeps local DNS working on the host while freeing the port for Pi-hole.

Step 1: Confirm what's using port 53

Run one of these commands (use sudo if needed):

sudo ss -tulpn | grep ':53'

or

sudo lsof -i :53

or the classic:

sudo netstat -tulpn | grep ':53'

Look for output like:

  • systemd-resolved or systemd-resolve listening on 127.0.0.53:53 (or sometimes 0.0.0.0:53)
  • Possibly dnsmasq, unbound, named (BIND), or another DNS service if you've installed one before.

If it's systemd-resolved (most common), proceed.

Step 2: Free up port 53 (for Pi-hole Docker)

You need to tell systemd-resolved not to listen on port 53 (via its stub listener), then restart it. This keeps local DNS working on the host while freeing the port for Pi-hole.

  1. Edit the config file:


    sudo nano /etc/systemd/resolved.conf

    Find the line #DNSStubListener=yes (it might be commented out).

    Change it to (uncomment and set):


    text:

    DNSStubListener=no

    Save and exit.

  2. Restart the service:


    sudo systemctl restart systemd-resolved

    (Or if it was fully disabled before, sudo systemctl enable --now systemd-resolved isn't needed — just restart.)

  3. Verify port 53 is now free:

    Run the check command from Step 1 again — no process should be listening on :53 anymore.

    -If the command returns blank, that is good.

     

    If still taken, double-check for other services (e.g., sudo systemctl stop unbound if you have Unbound installed, or sudo systemctl disable --now dnsmasq).

Step 3: Restart your Pi-hole container

Now try again:

sudo docker compose down
sudo docker compose up -d

It should start without the port error.

Important: Fix host DNS resolution after this change

Disabling the stub listener breaks the host's own DNS (it was using 127.0.0.53 as its resolver).

To restore it:

Once its running:  On your server (the host machine)

/etc/resolv.conf is currently:

nameserver 9.9.9.9
nameserver 149.112.112.112
(or whatever DNS you put in there)

Change it to this: (add nameserver 127.0.0.1)

nameserver 127.0.0.1
nameserver 9.9.9.9
nameserver 149.112.112.112


Commands:

Bash

sudo nano /etc/resolv.conf


Paste the three lines above, save and exit (Ctrl+O → Enter → Ctrl+X).

Then lock the file so it survives reboot:

Bash

sudo chattr +i /etc/resolv.conf


Test it works:

Bash

ping google.com


(Should resolve and ping.)

2. On your router

Current setting: Primary DNS = 192.168.0.1 (This is wrong — your router is telling devices to use itself for DNS, so Pi-hole is not being used by the network.)

Change it to:

  • Primary DNS Server: 192.168.0.x ← replace x with your Pi-hole server's actual LAN IP (Most likely 192.168.0.50, 192.168.0.100, etc. — whatever static IP you gave your server)
  • Secondary DNS Server (optional but recommended): 9.9.9.9

How to find your server's IP if unsure:

On the server run:

Bash

ip addr show | grep "inet " | grep -v 127.0.0.1


Look for the 192.168.0.x address on your main network interface (usually eth0 or enp...).

After changing the router DNS settings:

  • Save / Apply
  • Reboot the router if it asks (or just wait 1–2 minutes)
  • On your phone/laptop: toggle Wi-Fi off → on (or reboot device) to pick up new DHCP settings

Quick check after both changes

On any phone/laptop (not the server):

  • Open browser → go to http://192.168.0.x/admin (use your server's IP)
  • You should see the Pi-hole dashboard
  • Visit a site with ads (news site, YouTube app) → ads should be mostly gone
  • In Pi-hole dashboard → Query Log → you should see queries from multiple devices
Back to top