Skip to main content

Pi-hole Moving Port 53

Free up port 53 (for Pi-hole Docker)

In Linux, you need to tell systemd-resolved not to listen on port 53 (via its stub listener), then restart it. This keeps local DNS working on the host while freeing the port for Pi-hole.

Step 1: Confirm what's using port 53

Run one of these commands (use sudo if needed):

Bash


sudo ss -tulpn | grep ':53'

or

Bash


sudo lsof -i :53

or the classic:

Bash


sudo netstat -tulpn | grep ':53'

Look for output like:

  • systemd-resolved or systemd-resolve listening on 127.0.0.53:53 (or sometimes 0.0.0.0:53)
  • Possibly dnsmasq, unbound, named (BIND), or another DNS service if you've installed one before.

If it's systemd-resolved (most common), proceed.

Step 2: Free up port 53 (for Pi-hole Docker)

You need to tell systemd-resolved not to listen on port 53 (via its stub listener), then restart it. This keeps local DNS working on the host while freeing the port for Pi-hole.

  1.  

  1. Edit the config file:



    sudo nano /etc/systemd/resolved.conf


    Find the line #DNSStubListener=yes (it might be commented out).

    Change it to (uncomment and set):


    text:


    DNSStubListener=no

    Save and exit.

  2. Restart the service:

    Bash


    sudo systemctl restart systemd-resolved

    (Or if it was fully disabled before, sudo systemctl enable --now systemd-resolved isn't needed — just restart.)

  3. Verify port 53 is now free:

    Run the check command from Step 1 again — no process should be listening on :53 anymore.

    If still taken, double-check for other services (e.g., sudo systemctl stop unbound if you have Unbound installed, or sudo systemctl disable --now dnsmasq).

Step 3: Restart your Pi-hole container

Now try again:

Bash


sudo docker compose down
sudo docker compose up -d

It should start without the port error.

Important: Fix host DNS resolution after this change

Disabling the stub listener breaks the host's own DNS (it was using 127.0.0.53 as its resolver).

To restore it:

    Change the host's /etc/resolv.conf to point to 127.0.0.1 (since Pi-hole binds to host's port 53) or your server's LAN IP. Or keep public upstreams if you prefer.

    Step 3: Restart your Pi-hole container

    Now try again:

    Bash

    sudo docker compose down
sudo docker compose up -d

    It should start without the port error.

    Important: Fix host DNS resolution after this change

    Disabling the stub listener breaks the host's own DNS (it was using 127.0.0.53 as its resolver).

    To restore it:

    Remove the symlink to the stub resolver:

    Bash

    sudo rm /etc/resolv.conf


    Create a new static /etc/resolv.conf with a working upstream DNS (temporarily use public ones; later change to your Pi-hole IP once it's up):

    Bash

    sudo nano /etc/resolv.conf


    Put in something like:

    text

    nameserver 1.1.1.1
nameserver 1.0.0.1
# or nameserver 8.8.8.8


    Save.

    To make it persistent (prevent NetworkManager or whatever from overwriting):

      If using NetworkManager: Edit connections or add to /etc/NetworkManager/NetworkManager.conf:

      text

      [main]
dns=default


      Then sudo systemctl restart NetworkManager

      Or make resolv.conf immutable temporarily: sudo chattr +i /etc/resolv.conf

      Once Pi-hole is running and healthy:

        Change the host's /etc/resolv.conf to point to 127.0.0.1 (since Pi-hole binds to host's port 53) or your server's LAN IP. Or keep public upstreams if you prefer.

         

         

        Back to top