--- title: "mDNSResponder using data on Mac: what it is and if it is normal · Kilobat Guides" url: "https://kilobat.app/guides/what-is-mdnsresponder.html" description: "mDNSResponder is the macOS DNS and Bonjour daemon. Learn why it shows network traffic, when that is normal, and how to see and reduce it." --- macOS processes # What is mDNSResponder on Mac? `mDNSResponder` answers DNS lookups for every app on the Mac, and it runs Bonjour on the local network. Its traffic is the lookups of other apps. Process: `mDNSResponder` · Process: `mDNSResponderHelper` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026 ## Where you see it - `mDNSResponder` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat. - A firewall or network monitor asks if `mDNSResponder` can connect. - Its packet counts are high, but its bytes are low. ## What it is The man page calls it the “Multicast and Unicast DNS daemon”. It implements Multicast DNS and DNS Service Discovery, which Apple calls Bonjour. Since Mac OS X 10.6, it is also the system-wide DNS resolver. It sends DNS queries for other processes and keeps a cache of the answers. The program is `/usr/sbin/mDNSResponder`. `mDNSResponderHelper` is a helper with its own man page. ## Why it uses the network - **DNS lookups for apps.** Each time an app connects to a name, mDNSResponder can send a DNS query for it. Many apps make many lookups. - **Bonjour on the local network.** It listens on UDP port 5353 for Multicast DNS. It finds printers, speakers and other Macs. - **Encrypted DNS.** With an encrypted DNS profile, lookups go to that DNS server over HTTPS or TLS. See [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac.html). ## Is it normal? Yes. DNS answers are small, so mDNSResponder usually moves less data than the apps that it works for. Look closer if its traffic is high for a long time. A program that makes very many lookups, or a busy local network, can cause this. ## See how much it uses 1. Open Activity Monitor from Applications > Utilities. Click Network. 2. Type `mDNSResponder` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p mDNSResponder -P ``` 4. To see the DNS servers that it uses, show the resolver configuration. ``` scutil --dns ``` ## Reduce or pause it safely 1. Find the app that makes the lookups. Its own traffic often rises at the same time in Activity Monitor. 2. Quit or pause that app. The lookups stop with it. 3. If lookups fail and repeat, fix DNS first. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html). 4. If old answers cause errors, flush the DNS cache. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html). 5. Do not quit `mDNSResponder` in Activity Monitor. It is part of macOS, and other features depend on it. Without it, no app on the Mac can look up names. ## With Kilobat 1. Open the Kilobat app list and search for `mDNSResponder`. Its row shows the live rate and the bytes it moved. 2. Compare the speed of DNS servers from this Mac. ``` kilobat dns-benchmark ``` 3. In Terminal, see the same live list. Press / and type the name to search. ``` kilobat status --watch ``` 4. Show its traffic over one day. Names match `kilobat report --summary`. ``` kilobat bandwidth mDNSResponder day ``` 5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `mDNSResponder`. 6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs. ## Questions **Is mDNSResponder spyware?** No. It is Apple's DNS and Bonjour daemon in `/usr/sbin`, with a man page. The man page says that users should not run it manually. **Why does a firewall ask about mDNSResponder?** All DNS lookups on the Mac go through it. A firewall that watches DNS sees mDNSResponder, not the app that asked. ## Sources - mDNSResponder(8) and mDNSResponderHelper(8), man page installed with macOS 27.2 - [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac) - [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac) - nettop(1), man page installed with macOS 27.2 Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man ` in Terminal. ## Related guides - [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address. - [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time. - [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html): Every new site needs a DNS lookup before it can load. - [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour. - [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.