Core networking

What is networkserviceproxy?

networkserviceproxy is a transparent network proxy for Apple system services. With iCloud Private Relay on, Safari browsing and DNS lookups can go through it, so their bytes show under it.

Process: networkserviceproxyMade by AppleApplies to: macOS 14 Sonoma and later. iCloud Private Relay needs an iCloud+ subscription. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it.

Block with care

Blocking it can break iCloud Private Relay and Apple services that use its proxy. To stop the relay, turn off Private Relay instead.

Path
/usr/libexec/networkserviceproxy
launchd label
com.apple.networkserviceproxy
Signing identifier
com.apple.networkserviceproxy

What it is

The man page calls it the “Transparent network proxy for Apple system services”. The control plane of the NetworkServiceProxy framework runs inside it.

The man page says that it downloads the NetworkServiceProxy configuration from the internet and processes feedback from its clients. In some cases, it is also the data plane for specific clients.

The program is /usr/libexec/networkserviceproxy, started for each user as com.apple.networkserviceproxy.

Apple doesn't name Private Relay in the man page. Apple's host list names mask.icloud.com, mask-h2.icloud.com and mask-api.icloud.com for iCloud Private Relay.

Why it uses the network

  • Configuration. The man page says that it downloads its configuration from the internet.
  • Proxied traffic. When it is the data plane for a client, that client's traffic passes through it. Apple Platform Security says that Private Relay covers Safari browsing and all DNS lookups.

How much is normal

With Private Relay off, its traffic is usually small.

With Private Relay on, browsing in Safari can show under it. The amount is about what you browse.

Apple says that Private Relay uses an ingress proxy run by Apple and an egress proxy run by a content provider.

When it uses a lot, and why

  • Browsing with Private Relay on. Pages, images and video loaded in Safari go through the relay. A video stream in Safari adds up.
  • Many DNS lookups. Apple says that Private Relay includes all DNS name resolution requests.

Is it safe to block?

Block with care

Blocking it can break iCloud Private Relay and Apple services that use its proxy. To stop the relay, turn off Private Relay instead.

What breaks if you block it

  • iCloud Private Relay can't connect, so Safari may fail to load pages while it is on.
  • Apple system services that use the proxy may fail. Apple doesn't list them.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. To turn off Private Relay, choose Apple menu › System Settings. Click your name, then iCloud, then Private Relay.

  2. To skip it on one network, open that network's Details in Wi-Fi settings. Turn off Limit IP address tracking. See Limit IP address tracking on a Mac.

  3. If a site fails only with Private Relay, see iCloud Private Relay breaks some websites.

  4. Don't quit networkserviceproxy in Activity Monitor. macOS starts it again.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type networkserviceproxy in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. nettop cuts names to 15 characters.

    nettop -p 'networkservicep' -P

With Kilobat

  1. In the Kilobat app list, search for networkserviceproxy. Its row shows the live rate and what it moved today.

  2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.

  3. In Terminal, ask the same question. Add --json for scripts and agents.

    kilobat explain 'networkserviceproxy'

  4. Show its traffic over one day.

    kilobat bandwidth 'networkserviceproxy' day

  5. Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

mask.icloud.comThe iCloud Private Relay hosts. With Private Relay on, Safari browsing and DNS lookups go through them.Apple →mask-api.icloud.comAn iCloud Private Relay host on TCP 443. Unlike the relay hosts, Apple says that it supports proxies.Apple →

Questions

Why does Safari's traffic show under networkserviceproxy?

With Private Relay on, Safari's connections go through the relay. The proxy, not Safari, then sends the bytes.

Does Private Relay hide my traffic from Apple?

Apple says that no single party, not even Apple, can correlate your IP address and your browsing.

Sources

Checked on 1 November 2026.