Core networking

What is mDNSResponder?

mDNSResponder handles system DNS lookups for apps on the Mac, and it runs Bonjour on the local network. Its traffic can include other apps' lookups, which is why firewalls see it so often.

Process: mDNSResponderAlso seen as: mDNSResponderHelperMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups.

Don’t block

Don't block it. Many apps use the system resolver, so blocking it can break name lookups and connections.

Path
/usr/sbin/mDNSResponder /usr/sbin/mDNSResponderHelper
launchd label
com.apple.mDNSResponder.reloaded
Signing identifier
com.apple.mDNSResponder com.apple.mDNSResponderHelper

What it is

The man page calls it the “Multicast and Unicast DNS daemon”. It implements Multicast DNS and DNS Service Discovery, which Apple calls Bonjour.

Since Mac OS X 10.6, it is also the system-wide DNS resolver. It sends DNS queries for other processes and keeps a cache of the answers.

The program is /usr/sbin/mDNSResponder. launchd starts it for the system as com.apple.mDNSResponder.reloaded. mDNSResponderHelper is a helper with its own man page.

Why it uses the network

  • DNS lookups for apps. Each time an app connects to a name, mDNSResponder can send a DNS query for it. Busy apps make many lookups.
  • Bonjour on the local network. It uses UDP port 5353 for Multicast DNS. Apple lists that port for Bonjour, AirPlay, Home Sharing and printer discovery.
  • Encrypted DNS. With an encrypted DNS profile, lookups go to that DNS server over HTTPS or TLS. Apple lists doh.dns.apple.com for DNS over HTTPS. See Use encrypted DNS on a Mac.

How much is normal

DNS answers are small, so mDNSResponder usually moves less data than the apps that it works for.

Its cache answers repeat lookups without the network, which keeps its traffic low.

Look closer if its traffic is high for a long time. A program that makes very many lookups, or a busy local network, can cause this.

When it uses a lot, and why

  • An app that looks up many names. Browsers, crawlers and scanners resolve many names. Each lookup is small, but they add up.
  • Lookups that fail and repeat. When a DNS server doesn't answer, apps try again. Fix DNS first. See DNS not resolving on a Mac.
  • A busy Bonjour network. On a network with many printers, speakers and computers, there is more Multicast DNS traffic. It stays local.

Is it safe to block?

Don’t block

Don't block it. Many apps use the system resolver, so blocking it can break name lookups and connections.

What breaks if you block it

  • Apps using the system resolver may be unable to look up names, so websites and other connections can fail.
  • Bonjour stops, so AirPlay, AirPrint and shared computers can't be found.
  • A firewall rule for it affects system DNS lookups for multiple apps, not just one app. Block the app, or the host, instead.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. Find the app that makes the lookups. Its own traffic often rises at the same time in Activity Monitor.

  2. Quit or pause that app. The lookups stop with it.

  3. If lookups fail and repeat, fix DNS first. See DNS not resolving on a Mac.

  4. If old answers cause errors, flush the DNS cache. See Flush the DNS cache on a Mac.

  5. Don't quit mDNSResponder in Activity Monitor. Name lookups stop until macOS starts it again.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type mDNSResponder in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p 'mDNSResponder' -P

With Kilobat

  1. Kilobat's filter sees the app that opens each connection. It names the app, not mDNSResponder.

  2. Compare DNS servers with a benchmark on this network.

    kilobat dns-benchmark

  3. In Connections, click ⓘ on one of its rows. The popover shows this answer without going online.

  4. Ask the same question in Terminal.

    kilobat explain mDNSResponder

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

doh.dns.apple.comApple's DNS over HTTPS (DoH) host. Apple lists it for encrypted DNS resolution in macOS Big Sur and later.Apple →*.apple-dns.netApple's domain for the DNS of iCloud services. iCloud hosts resolve through names under it.Apple →

Questions

Is mDNSResponder spyware?

No. It is Apple's DNS and Bonjour daemon in /usr/sbin, with a man page. The man page says that users should not run it manually.

Why does a firewall ask about mDNSResponder?

Many apps use the system DNS resolver. A firewall can see mDNSResponder sending a query on an app's behalf; some apps use their own resolver.

Sources

Checked on 1 November 2026.