What is using port 5353 on my Mac?

Port 5353 is mDNS, the multicast DNS protocol behind Bonjour. On a Mac it's almost always mDNSResponder, the system service that discovers printers, AirPlay devices, and other local services. Run sudo lsof -i :5353 to confirm.

Is it safe to kill the process on port 5353?

No. It's mDNSResponder, a core macOS service. Killing it breaks local device discovery and name resolution until it restarts. There's no reason to kill it under normal use.

Why is port 5353 always in use on my Mac?

Bonjour runs constantly so your Mac can find and advertise local services like printers, AirPlay, and file sharing. An always-on 5353 listener is normal and expected.

Port 5353: What's Using It and Is It Safe to Kill?

Port 5353 is the multicast DNS (mDNS) port, the foundation of Apple’s Bonjour. It’s how your Mac finds printers, AirPlay targets, and other devices on the local network without any manual configuration. On macOS, 5353 is essentially always in use.

What typically listens on port 5353

mDNSResponder: The macOS system service that runs Bonjour. This is the usual and expected owner.
Bonjour-based discovery: Printing, AirPlay, file sharing, and many apps rely on it.
Other mDNS tools: Some cross-platform discovery software also uses 5353.

This is core networking infrastructure, not a stray process.

Is it safe to kill?

No. Leave it alone. mDNSResponder handles local service discovery and a share of name resolution, so killing it breaks finding printers and AirPlay devices until launchd restarts it. There’s no normal reason to stop it.

Is it suspicious?

mDNSResponder on 5353 is completely normal. The only thing worth checking is whether the owner actually is mDNSResponder and not an unfamiliar process borrowing the port. The command below confirms it.

How to find what’s on port 5353 on macOS

sudo lsof -i :5353

You should see mDNSResponder owned by a system user. If you do, there’s nothing to do; it’s working as intended.

How it relates to other ports

mDNS pairs with regular DNS on port 53 for name resolution: 53 handles internet lookups, 5353 handles local-network discovery.

Portie shows port 5353 with its owning process in its live view, so you can confirm Bonjour is being handled by the system and nothing unexpected is using it.