Since Consul is meant to be able to act like a DNS server, it is preferable for it to be THE DNS server, running on port 53. Binding to this port requires root, but it is not ideal for consul itself to actually run as root.

Consul should take a -user flag so it can setuid to that user after binding ports.