What is networkserviceproxy on Mac?

Last updated: 2026-07-31

What it is

networkserviceproxy is an Apple-supplied macOS background agent that manages network-relay and privacy-proxy infrastructure. The executable is installed at /usr/libexec/networkserviceproxy, uses the identifier com.apple.networkserviceproxy, and is registered by an Apple launchd configuration. Those details have been verified through local inspection of macOS.

Calling networkserviceproxy only “the iCloud Private Relay client” leaves out part of the picture. Local inspection shows policies associated with Safari, Mail, privacy proxies, and oblivious relays. Apple’s public documentation describes relay technology used by iCloud Private Relay, Mail Privacy Protection, and Safari’s protection against trackers learning an IP address.

There is an important limit to what can be said with confidence. Apple does not publish a manual dedicated to networkserviceproxy, nor does it explicitly map every responsibility of the executable. Its identity and launch configuration are directly verified, and the behavior of the related privacy features is documented, but claims that every connection or byte belongs to one specific feature would go beyond the available evidence.

Why it talks to the network

When iCloud Private Relay is enabled, eligible Safari browsing can pass through a two-relay system. DNS-resolution requests and insecure HTTP traffic from apps can also be covered. Apple operates the ingress relay, while a third-party content provider operates the second relay. The design separates information so that no single relay operator, including Apple, can see both the user’s identity and every destination.

Mail has related reasons to generate relay traffic. When Protect Mail Activity or Hide IP Address is enabled, Mail can fetch remote message content in the background through two relays. As a result, networkserviceproxy should not be interpreted as carrying Safari activity alone.

The agent also obtains relay configuration and authentication tokens from Apple service endpoints. That can produce small connections even when no protected page, download, or remote message content is moving. Other managed or system relay uses may exist, but their exact association with networkserviceproxy has not been verified. There is therefore no sound basis for assigning every observed connection to Private Relay, Mail, or any other single feature.

How much traffic is normal

There is no reliable normal byte range for networkserviceproxy. Apple does not publish one, and the amount is highly dependent on what the Mac is doing.

When no protected content is moving, the agent may show only low, intermittent traffic for relay configuration and authentication tokens. When eligible content is being relayed, usage can instead scale with Safari pages and downloads, DNS requests, insecure HTTP app traffic, and remote content fetched by Mail. A quiet period and a much larger total can both be consistent with the documented role of the relay infrastructure.

A precise interpretation of the total is not possible from the process name alone. Apple does not document how Activity Monitor attributes every relayed byte, so it is unverified whether every byte shown beside networkserviceproxy represents payload traffic handled directly by that executable. No fixed MB threshold can distinguish normal behavior from a problem, and a large count by itself does not prove data exfiltration.

Can you turn it off

There is no supported System Settings switch that disables the networkserviceproxy agent itself. Apple provides controls for the individual privacy features that use relay technology.

For iCloud Private Relay, open System Settings > [your name] > iCloud > Private Relay, then turn off Private Relay. To change the behavior for Wi-Fi, use System Settings > Network > Wi-Fi > Details, then turn off Limit IP address tracking. For Ethernet, open System Settings > Network > [Ethernet service] > Advanced and turn off Limit IP address tracking.

Mail has separate controls under Mail > Settings > Privacy. Deselecting Protect Mail Activity and Hide IP Address disables those Mail privacy features.

Turning off Private Relay removes its IP-address and browsing-privacy protections for eligible traffic. Turning off the Mail options can expose the Mac’s IP address to message senders and allow them to infer when remote email content is fetched. These controls disable particular features rather than the system agent. Forcibly terminating or modifying networkserviceproxy is unsupported, and launchd may start it again.

What people get wrong

• “networkserviceproxy is malware or unexplained data exfiltration.” networkserviceproxy is an Apple system executable at /usr/libexec/networkserviceproxy, registered by an Apple launchd configuration. A traffic total alone does not establish that data is being exfiltrated.

• “It belongs only to iCloud Private Relay and carries only Safari traffic.” That description is too narrow. Apple uses relay technology for Safari privacy features and Mail Privacy Protection, while Private Relay can also cover DNS resolution and insecure HTTP traffic from apps.

• “Private Relay tunnels every packet on the Mac like a full-device VPN.” Apple documents a limited scope. Local-network traffic, private-domain traffic, VPN traffic, Network Extension traffic, and traffic that is already proxied are among the described exclusions.

• “A large byte count proves that the Mac is leaking system data.” That conclusion is unsupported. Relayed pages, downloads, DNS requests, app traffic, or Mail content requested by the user may contribute to the displayed amount. Apple has not published a complete rule explaining how every byte is assigned to networkserviceproxy.

• “Killing or deleting networkserviceproxy is a safe performance optimization.” It is an unsupported system component, and launchd may relaunch it. Apple’s feature-specific settings are the supported controls for deciding whether to use the associated privacy protections.

• “Apple can see both my identity and every destination through Private Relay.” Apple documents a two-relay design intended to prevent any one relay operator, including Apple, from seeing both pieces of information.

Seeing what it actually used

The useful next step is to measure networkserviceproxy over the same period as the Safari, Mail, and app activity you want to understand. Bytetally’s per-process statistics can show how its usage changes between an idle period and a period with protected traffic. Treat that measurement as evidence of volume and timing, not as proof that every byte came from one specific relay feature.

Related processes

Common questions