mDNSResponder
executablemacOS3.3 MBx86_64, arm64
Network daemon — manages WiFi, VPN, DNS, and content filtering policies
Runs as a privileged system daemon controlling WiFi hardware configuration, VPN connections, and DNS resolution. Listens for incoming network connections and makes outgoing requests to Apple endpoints for analytics and policy updates. Communicates with the WiFi peer-to-peer daemon via XPC and accesses IOKit user clients for direct hardware and driver interaction. Implements content filtering and DNS proxy functionality while maintaining keychain access for certificates and credentials. Enforces hardened runtime protections and logs telemetry to Apple's unified analytics system.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 15.0.0
- SDK
- 26.1.0
- File Size
- 3.3 MB
- UUID
- C31F7AB6-4FA2-3478-B237-5D75A4C75AB7
- Analyzed
- 2026-04-09T10:14:58Z
- CDHash
- 7c48d8deadcd4d7b6382351a3f2d6c5c9416a0e53787aefbbaf9d4a956b35540
Capabilities
KeychainKeychain access group membership
keychain-access-groupsNetworkCore networking (HTTP, FTP, DNS)
/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetworkNetworkVPN, content filter, DNS proxy APIs
/System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtensionNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationNetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkHardwareException: access additional IOKit user clients
com.apple.security.exception.iokit-user-client-class[object Object]HardwareWiFi configuration (private)
/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFiHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks25
RunningBoardServices(weak)CFNetworkCoreAnalytics(weak)CoreFoundationCoreServicesCoreWiFi(weak)DeviceToDeviceManager(weak)FoundationIOKitNetworkExtension(weak)PowerLog(weak)SecurityStatusKit(weak)SymptomReporter(weak)SystemConfigurationUniformTypeIdentifiers(weak)WebFilterDNS(weak)libarchive.2.dyliblibbsm.0.dyliblibicucore.A.dylibNetworklibnetworkextension.dylib(weak)libxml2.2.dyliblibobjc.A.dyliblibSystem.B.dylib
Entitlements41
Interesting Strings
Bundle IDs(157)
File Paths(40)
/AppleInternal/Library/BuildRoots/4~B_wsugDbbLLlThKA2wcUW5yrOUvszCfuaiEdFuE/Library/Caches/com.apple.xbs/Sources/mDNSResponder/mDNSMacOSX/dns_push/dns_push_discovery.c/AppleInternal/Library/BuildRoots/4~B_wsugDbbLLlThKA2wcUW5yrOUvszCfuaiEdFuE/Library/Caches/com.apple.xbs/Sources/mDNSResponder/mDNSMacOSX/dnssd_server.c/AppleInternal/Library/BuildRoots/4~B_wsugDbbLLlThKA2wcUW5yrOUvszCfuaiEdFuE/Library/Caches/com.apple.xbs/Sources/mDNSResponder/mDNSMacOSX/dnssec_v2/dnssec.c/AppleInternal/Library/BuildRoots/4~B_wsugDbbLLlThKA2wcUW5yrOUvszCfuaiEdFuE/Library/Caches/com.apple.xbs/Sources/mDNSResponder/mDNSMacOSX/dnssec_v2/dnssec_mdns_core.c/AppleInternal/Library/BuildRoots/4~B_wsugDbbLLlThKA2wcUW5yrOUvszCfuaiEdFuE/Library/Caches/com.apple.xbs/Sources/mDNSResponder/mDNSMacOSX/dnssec_v2/dnssec_objs/dnssec_obj_denial_of_existence.c
iokit_constants(3)
telemetry(40)
URLs & Endpoints(12)
$http://crl.apple.com/codesigning.crl0%http://www.apple.com/appleca/root.crl0<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><m:%s xmlns:m="urn:schemas-upnp-org:service:WAN%sConnection:1">Alternatively, you can send email to radar-3387020@group.apple.com. (Note number is different.)
Network Surfaceentitled
Networking Frameworks
Endpoints(31)
Ipv4239.255.255.250
Hostnameschemas.xmlsoap.org
Ipv601:40:48
HostnamemDNSResponder-2881.40.18
Hostnameresrec.name
Hostnamegroup.apple.com
Hostnamed.in-addr.arpa
Hostname254.169.in-addr.arpa
Hostname8.e.f.ip6.arpa
Hostname9.e.f.ip6.arpa
Ipv41.0.0.127
Hostname1.0.0.127.in-addr.arpa
Ipv41.0.0.0
Ipv40.0.0.0
Urlhttps://%s%s
Hostnameu.in-addr.arpa
Hostnamedeveloper.apple.com
Hostnamewww.dns-sd.org
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
API Usage
DNA Capability Vector
Location
0
Keychain
1
Network
7
Storage
0
Hardware
3
IPC
1
Analytics
1
Security
2
System
1
Behavioral Profile
URL Endpoints
12
Telemetry Strings
40
File Paths
40
Bundle IDs
157
IOKit Constants
3
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1770 functions identified
Functions(1770)
0x1000014d0main
0x100003bacLogMsgWithLevel
0x100003cc8mDNS_vsnprintf
0x100004b84KQueueSet
0x100004becmDNSMacOSXSystemBuildNumber
0x100004e3cmDNSPlatformRawTime
0x100004f04mDNS_snprintf
0x100004f30GetUserSpecifiedLocalHostName
0x100004f88SetupSocket
0x1000057acSystemWakeForNetworkAccess
0x1000058f0UpdateInterfaceList
0x100006f48myGetIfAddrs
0x100006f8cSetupAddr
0x100007060NetWakeInterface
0x100007690mDNS_SetFQDN
0x100007870AppendDomainLabel
0x10000790cAppendLiteralLabelString
0x1000079acmDNS_Lock_
0x100007cfcSameDomainNameCS
0x100007db4mDNS_Unlock_
Imports887 symbols from 22 dylibs
Exports1
_mh_execute_header0x0