How the scan works
For every port in the list the server opens an ordinary TCP connection to the target, exactly as a browser or mail client would, and records what happens. The handshake either completes, is refused, or gets no answer within the timeout. Nothing is sent after the connection opens and it is closed at once, so there is no banner grabbing, no version detection, no SYN-only tricks and no UDP.
Before any connection the target is resolved and checked. A hostname is turned into its first address, which appears as IP in the result header, and the scan goes to that single address. Up to eight ports are probed at the same time, so a profile of 17 ports usually finishes in a few seconds, while a list of filtered ports takes longer because each one waits out its timeout.
The response time column is the time to reach a verdict for that port: the handshake duration for open ports, the time until the refusal for closed ones and, for filtered ones, usually the full timeout. It is a rough latency figure, not a benchmark.
Open, closed and filtered
OPEN means the handshake completed: a process is listening and the firewall let the connection through. CLOSED means the host answered with a reset (ECONNREFUSED): the host is up and reachable on that path, but nothing is bound to the port. FILTERED means no answer arrived before the timeout, or the socket failed in some other way, which is what a firewall that drops packets looks like from outside.
Read the three counters together. A row of FILTERED across every port suggests a default-deny firewall, a host that is down, or an address that no longer belongs to the target. A mix of OPEN on 80 and 443 with FILTERED everywhere else is the usual shape of a hardened web server. CLOSED results on many ports mean the host is reachable and the firewall is permissive, which is worth knowing even when nothing is listening.
Because the method is connect-only, the tool cannot tell a dropped packet from a dead host, and cannot see UDP services at all. A port that is open only to certain source addresses will also show as FILTERED, since the probe comes from the DNSfinder server, not from your network.
Choosing a profile
Five preset lists cover the common cases, and a custom list takes any ports you type. Service names come from a built-in table of well-known assignments. A port outside that table is labelled Port N with the description Unassigned or custom service, which says nothing about what is running there.
- Quick (17 ports): 21, 22, 25, 53, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 3389, 5432, 8080 and 8443.
- Web: 80, 443, 8080, 8443, 8000, 8888, 3000, 5000 and 9000, including the usual development server ports.
- Mail: 25, 110, 143, 465, 587, 993, 995 and 2525.
- Database: 1433 (MSSQL), 1521 (Oracle), 3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), 27017 (MongoDB) and 9200 (Elasticsearch).
- Common (top 20): the Quick list plus 23, 123, 389 and 445, minus 8443.
- Custom: comma-separated numbers between 1 and 65535. The first 25 are scanned and anything beyond that is dropped.
What an open port should make you check
An open port is only a problem when it should not be reachable from the internet. Database listeners are the usual surprise: MySQL on 3306, PostgreSQL on 5432, Redis on 6379 and MongoDB on 27017 should be bound to localhost or a private interface and reached through SSH or a VPN. Redis and MongoDB accept connections without a password unless you configure one.
Remote access services deserve the same scrutiny. RDP on 3389, Telnet on 23 and SMB on 445 exposed to the public internet are brute-forced within hours of appearing. SSH on 22 is acceptable with key-only authentication. An open 25 on a machine that is not a mail server, or 8080 and 8888 left over from a test, are the kind of thing this scan is meant to catch.
Once you know what is open, the neighbouring tools go deeper: the security scanner grades the HTTP headers and TLS of a web port, the SMTP test talks to port 25 or 587 and reports STARTTLS and authentication, and the IP lookup tells you whose network the address sits in.
Targets the scanner refuses and other limits
Addresses that are private, loopback, link-local or otherwise reserved are rejected before anything is sent: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16 including the cloud metadata address, carrier-grade NAT 100.64.0.0/10, the documentation and benchmark ranges, multicast and the IPv6 equivalents. A hostname that resolves to any such address is refused too, with a message naming the offending IP, so DNS tricks cannot point the scanner inward.
That means you cannot scan your own router at 192.168.1.1 from here. Find your public address with What is my IP and scan that instead, which shows what the outside world sees. Only scan systems you own or have written permission to test. A full TCP connect is logged by most servers and intrusion detection systems.
Scans are limited per visitor IP both per minute and per day, since each one costs the target a burst of connections. Results can be copied or downloaded as JSON or CSV, and nothing you scan is stored, as the privacy policy sets out.