--- title: "mDNSResponder: what it is, why it uses the network, and whether to block it · Kilobat" url: "https://kilobat.app/processes/mdnsresponder" description: "mDNSResponder handles macOS system DNS lookups and runs Bonjour. Why its traffic can reflect other apps' lookups, what is normal, and why you shouldn't block it." --- Core networking # What is mDNSResponder? `mDNSResponder` handles system DNS lookups for apps on the Mac, and it runs Bonjour on the local network. Its traffic can include other apps' lookups, which is why firewalls see it so often. Process: `mDNSResponder` · Also seen as: `mDNSResponderHelper` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. Don’t block Don't block it. Many apps use the system resolver, so blocking it can break name lookups and connections. Path `/usr/sbin/mDNSResponder` `/usr/sbin/mDNSResponderHelper` launchd label `com.apple.mDNSResponder.reloaded` Signing identifier `com.apple.mDNSResponder` `com.apple.mDNSResponderHelper` ## What it is The man page calls it the “Multicast and Unicast DNS daemon”. It implements Multicast DNS and DNS Service Discovery, which Apple calls Bonjour. Since Mac OS X 10.6, it is also the system-wide DNS resolver. It sends DNS queries for other processes and keeps a cache of the answers. The program is `/usr/sbin/mDNSResponder`. launchd starts it for the system as `com.apple.mDNSResponder.reloaded`. `mDNSResponderHelper` is a helper with its own man page. ## Why it uses the network - **DNS lookups for apps.** Each time an app connects to a name, `mDNSResponder` can send a DNS query for it. Busy apps make many lookups. - **Bonjour on the local network.** It uses UDP port 5353 for Multicast DNS. Apple lists that port for Bonjour, AirPlay, Home Sharing and printer discovery. - **Encrypted DNS.** With an encrypted DNS profile, lookups go to that DNS server over HTTPS or TLS. Apple lists `doh.dns.apple.com` for DNS over HTTPS. See [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac). ## How much is normal DNS answers are small, so `mDNSResponder` usually moves less data than the apps that it works for. Its cache answers repeat lookups without the network, which keeps its traffic low. Look closer if its traffic is high for a long time. A program that makes very many lookups, or a busy local network, can cause this. ## When it uses a lot, and why - **An app that looks up many names.** Browsers, crawlers and scanners resolve many names. Each lookup is small, but they add up. - **Lookups that fail and repeat.** When a DNS server doesn't answer, apps try again. Fix DNS first. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found). - **A busy Bonjour network.** On a network with many printers, speakers and computers, there is more Multicast DNS traffic. It stays local. ## Is it safe to block? Don’t block Don't block it. Many apps use the system resolver, so blocking it can break name lookups and connections. What breaks if you block it - Apps using the system resolver may be unable to look up names, so websites and other connections can fail. - Bonjour stops, so AirPlay, AirPrint and shared computers can't be found. - A firewall rule for it affects system DNS lookups for multiple apps, not just one app. Block the app, or the host, instead. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Find the app that makes the lookups. Its own traffic often rises at the same time in Activity Monitor. 2. Quit or pause that app. The lookups stop with it. 3. If lookups fail and repeat, fix DNS first. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found). 4. If old answers cause errors, flush the DNS cache. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac). 5. Don't quit `mDNSResponder` in Activity Monitor. Name lookups stop until macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `mDNSResponder` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p 'mDNSResponder' -P ``` ## With Kilobat 1. Kilobat's filter sees the app that opens each connection. It names the app, not `mDNSResponder`. 2. Compare DNS servers with a benchmark on this network. ``` kilobat dns-benchmark ``` 3. In Connections, click ⓘ on one of its rows. The popover shows this answer without going online. 4. Ask the same question in Terminal. ``` kilobat explain mDNSResponder ``` The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [doh.dns.apple.com](https://kilobat.app/hosts/doh-dns-apple-com): Apple's DNS over HTTPS (DoH) host. Apple lists it for encrypted DNS resolution in macOS Big Sur and later. - [*.apple-dns.net](https://kilobat.app/hosts/apple-dns-net): Apple's domain for the DNS of iCloud services. iCloud hosts resolve through names under it. ## Questions **Is mDNSResponder spyware?** No. It is Apple's DNS and Bonjour daemon in `/usr/sbin`, with a man page. The man page says that users should not run it manually. **Why does a firewall ask about mDNSResponder?** Many apps use the system DNS resolver. A firewall can see `mDNSResponder` sending a query on an app's behalf; some apps use their own resolver. ## Sources - mDNSResponder(8) and mDNSResponderHelper(8), man pages installed with macOS 27.2 - launchd property list com.apple.mDNSResponder.reloaded, macOS 27.2 - [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac) - [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229) - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) Checked on 1 November 2026. ## Related - [configd](https://kilobat.app/processes/configd): Part of macOS. It keeps the Mac's network configuration and gets its IP addresses with DHCP, so it sends small amounts of traffic to the router. - [netbiosd](https://kilobat.app/processes/netbiosd): Part of macOS. It registers and browses NetBIOS names for Windows-style file sharing. Its traffic stays on the local network. - [networkserviceproxy](https://kilobat.app/processes/networkserviceproxy): Part of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it. - [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac) - [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found) - [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac) - [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac)