What is syspolicyd on macOS?

Last updated: 2026-07-31

What it is

syspolicyd is Apple’s System Policy daemon and one of the core background components behind Gatekeeper on macOS. Its job is to evaluate whether applications, installer packages, plug-ins, and other code may be installed, loaded, or executed. The executable is located at /usr/libexec/syspolicyd, and its code-signing identifier is com.apple.syspolicyd.

That evaluation involves more than asking whether an app has been notarized. syspolicyd maintains system policies, an evaluation cache, notarization tickets, and revocation tickets. These resources allow many decisions to be made locally, including decisions based on a ticket attached to the software or a result already held in the cache.

On modern macOS releases, syspolicyd also participates in XProtect scanning and related maintenance. Describing it only as a notarization lookup service therefore misses part of its security role: it contributes to the checks macOS performs before allowing code to run and helps the system use current malware and revocation information.

Why it talks to the network

A network request may be needed when Gatekeeper evaluates software for which the Mac has neither a valid attached notarization ticket nor a usable cached ticket. In that case, syspolicyd can query Apple’s notarization ticket service. The current macOS executable explicitly references Apple’s public CloudKit record-query service at api.apple-cloudkit.com.

It also performs background synchronization of notarization revocation tickets and security policies published by Apple. These updates matter because a previous approval is not the end of the process: the system still needs current information about revoked tickets and malware policy. XProtect-related updates are another verified reason for network activity.

This does not mean the app itself is sent to Apple during every evaluation. Normal notarization lookups center on code hashes and tickets. Developers submit their software to Apple’s notarization service before distribution, while the Mac later uses the resulting ticket when assessing that software. Code-signing integrity and the question of whether local files have been modified are primarily checked on the Mac.

There is one important exception to the usual metadata traffic. If XProtect detects malware and the user explicitly agrees to share a sample, the associated process may upload the malicious executable or the entire app bundle to Apple. Certificate trust or OCSP traffic can also be handled by other processes such as trustd; the exact division between processes can vary between macOS versions.

How much traffic is normal

syspolicyd can remain completely quiet while the Mac is idle. Routine notarization ticket queries, revocation checks, and policy synchronization are intermittent control-plane metadata exchanges. They are normally much smaller than downloading an application or a system update, but Apple has not published a normal traffic range or a reliable per-request size.

Activity can rise when you install software, open newly installed code for the first time, or generate many new binaries in a short period. Those situations create more items that may need evaluation, so a higher request count is possible without establishing a fixed number that every Mac should match.

Claims that each request is only a few kilobytes are not reliably verified. There is likewise no published upper limit that can be used as a universal threshold. A user-approved malware sample upload is a different category from a ticket query and may approach the size of the malicious executable or the entire app bundle. Traffic should therefore be judged in context rather than against an invented MB limit.

Can you turn it off

Apple does not provide a System Settings path or switch for disabling syspolicyd. The “Allow applications downloaded from” setting changes what Gatekeeper accepts; it does not stop this system daemon.

Blocking its connections or forcibly disabling it can prevent the Mac from retrieving missing notarization tickets, current revocation information, and updated malware decisions. Software without a valid local ticket may then be delayed, fail during installation, or fail when first opened. Interfering with the daemon also weakens the protections supplied by Gatekeeper and XProtect.

Manually ending the process is not a lasting way to disable it. launchd normally starts it again when macOS needs it. A low-volume background process returning after termination is therefore expected behavior, not evidence that an application has installed another copy.

What people get wrong

1. “Every application launch causes an online check with Apple.” Many evaluations are completed using an attached notarization ticket, a locally stored ticket, or the evaluation cache. Network access is generally needed when a valid ticket is missing or when revocation information must be refreshed.

2. “syspolicyd uploads every app to Apple for scanning.” Routine notarization queries focus on code hashes and tickets. Apple documents a possible executable or full app-bundle upload only when XProtect has detected malware and the user explicitly consents to sharing the sample.

3. “Apple’s servers decide in real time whether an app has been modified.” The Mac primarily verifies code-signing integrity locally. A notarization ticket records that Apple previously checked the software submitted by its developer; it does not replace the local integrity check.

4. “Blocking syspolicyd only saves bandwidth.” Blocking it can interfere with notarization ticket retrieval, revocation updates, malware policies, and XProtect-related maintenance. The practical result may include delayed or failed installation and first launch, as well as weaker security decisions.

5. “Its traffic is always only a few kilobytes.” Apple has published neither a per-request figure nor a normal traffic range for this daemon. Metadata lookups are generally small, but a consented malware sample upload can be as large as the executable or app bundle being shared.

6. “The Gatekeeper option in System Settings is the syspolicyd switch.” It is not. That option adjusts Gatekeeper’s acceptance policy, while syspolicyd continues to run as a system service.

Seeing what it actually used

Instead of estimating from a single connection, find syspolicyd in Bytetally’s per-process statistics and observe it across the period you care about. Compare an idle period with the time around an installation or first launch, and keep possible user-approved malware sample sharing separate from ordinary metadata traffic.

Related processes

Common questions