A firewall change request asks you to permit directory service lookups that are protected with TLS between an application server and a domain controller. Which destination port must the rule allow?