A DNSHacker or hacker may attempt to perform zone delivery (TCP), spoof DNS(UDP), or hide other communications. Therefore, the firewall usually filters or logs port 53. It should be noted that you usually think of port 53 as a UDP source port. Unstable firewalls usually allow this kind of communication and think it is a reply to DNS queries. Hackers often use this method to penetrate firewalls.