mDNSResponder

Short spikes come from bursts of lookups: many new tabs, an app syncing with many servers, or devices joining the network. Sustained use usually points to something retrying lookups in a loop, a misbehaving VPN or DNS filter, or a network where Bonjour announcements never stop.

When websites fail to load by name but work by address, or a site changed servers and the Mac still goes to the old one, the cache is the suspect.

Two commands in Terminal clear the cache on recent macOS and tell mDNSResponder to reload, with no restart needed.

1. Open Terminal.
2. Run sudo dscacheutil -flushcache, and enter your password when asked.
3. Run sudo killall -HUP mDNSResponder.

It runs as its own system account, so Activity Monitor hides it until you ask for every process. Terminal can show its two jobs, DNS and Bonjour, one at a time.

1. Open Activity Monitor, choose View → All Processes and type mdns in the search field. You will see mDNSResponder under the _mdnsresponder account, and mDNSResponderHelper under root.
2. Watch % CPU on the CPU tab and the packet columns on the Network tab. Short spikes are normal. A steady load while you are not browsing is worth a look.
3. To see which DNS servers the Mac is using, open Terminal and run scutil --dns. Resolver #1 lists the servers used for most lookups under nameserver[0], nameserver[1] and so on.
4. To test a lookup through mDNSResponder itself, run dns-sd -G v4v6 apple.com. It prints each address as it arrives. Press Control-C to stop.
5. To see what Bonjour finds on your network, run dns-sd -B _services._dns-sd._udp local.. It lists the kinds of service that devices around you announce, such as _airplay and _ipp for printers. Press Control-C to stop.

Normal: close to zero, with brief spikes when you open many tabs, join a network, or a device on the network wakes up.

Worth looking into: steady CPU or network use for hours, or names that fail to resolve on one network but work on another. The usual causes:

• A VPN or DNS filter that adds its own resolvers and keeps changing them. scutil --dns shows extra resolvers with a domain line when a VPN sends some names to its own servers.
• An app or script that looks up names in a tight loop, often one that keeps retrying a server it cannot reach.
• A busy local network, such as an office or a shared building, with many devices announcing themselves over Bonjour.
• A network that hands out a DNS server that is slow or does not answer, so lookups wait and retry.

Names on the internet, such as apple.com, go to the DNS servers your network or you have set. Names ending in .local, such as your Mac's own network name, never leave the local network: mDNSResponder asks the devices around it directly, which is the multicast DNS that gives it the m in its name.

That is why scutil --dns lists resolvers for local marked mdns. If a printer or a shared Mac can be reached by its .local name at home but not at work, the work network is blocking those local announcements, not the internet.