What Is distnoted on Mac? The Notification Daemon Explained

distnoted is the distributed notification daemon that ships with macOS. Its job is to relay messages between running processes when one of them broadcasts a change that others may care about.

The mechanism behind it is the distributed notification system, exposed to developers as NSDistributedNotificationCenter. Think of it as a bulletin board rather than a phone call. An app or system component posts a short message that says, in effect, "this thing changed," and any process that registered interest in that kind of message gets handed a copy. Neither side needs to know the other exists. distnoted is the broker in the middle, keeping the list of who is listening and passing the messages along.

The events being announced are ordinary ones: a preference was modified, a device was attached, a user setting was flipped. Apps rely on this to react to changes made elsewhere on the system without constantly polling for them. It is unglamorous plumbing, which is why it has no interface and no documentation aimed at end users. It is a first-party Apple binary, code-signed by Apple, present on every modern macOS install, and not something you installed.

Most people meet distnoted the same way: something felt slow, Activity Monitor came out, and an unrecognised name looked suspicious. The name does most of the damage. "distnoted" reads like an abbreviation, and what people tend to guess at is distributed in the networking sense, as in remote servers and machines talking to each other.

That guess is wrong, and correcting it is the most useful thing this article can do. distnoted is inter-process communication on your local machine, not network traffic. "Distributed" here means distributed across the processes running on your Mac, not across a network. The daemon does not dial out to the internet, does not fetch anything, and does not report anything anywhere. Its entire universe is the set of processes on the machine in front of you.

This matters because many of the people searching for the name arrived while auditing network activity. They saw a connection they could not explain, went looking at running processes, and pinned the traffic on the unfamiliar name. If that describes you, the attribution is almost certainly mistaken. distnoted is a poor suspect because it does not have the capability in the first place, and whatever opened that connection was something else.

distnoted is not malware. It is an Apple system daemon that has been part of macOS for many years. Malware occasionally borrows the names of legitimate system processes to blend in, so the instinct to check is a reasonable one, and you can settle it yourself without installing anything.

In Activity Monitor, double-click the distnoted entry to open its Info window. The tabs there show the parent process, memory statistics, and open files. A genuine system daemon shows a plausible launch chain rather than something odd like a browser or a downloaded application, and it will not be running out of your Downloads or Desktop folder. For a stronger check, the codesign command in Terminal reports the signing authority of a running binary, and for the real distnoted that authority traces back to Apple.

The other thing that triggers suspicion is seeing several distnoted processes at once. This is normal. The daemon runs per session or per context rather than as a single system-wide instance, so a machine with a logged-in user and various background contexts will show a handful of them. Three, four, or more is unremarkable. They typically show different accounts in the User column, including system accounts, which is the giveaway that they are separate contexts rather than duplicates. In normal operation each sits at essentially zero CPU. A row of idle distnoted processes is the healthy state.

Occasionally distnoted stops being invisible and starts consuming real CPU, sometimes enough to spin up fans. When that happens, the key point is that distnoted is usually the symptom rather than the cause.

Remember what it does: it relays messages that other processes post. If it is working hard, something is posting a lot of messages. Some application has ended up in a loop where it broadcasts a notification, reacts, and broadcasts again, or it announces a change hundreds of times a second when once would do. The daemon is doing its job at a volume it was never meant to handle. Killing it accomplishes nothing durable, because macOS restarts it and the noisy app resumes immediately.

Finding the culprit is a process of elimination. Sort Activity Monitor by CPU and look at what else is elevated at the same moment. Often there is a second process near the top, and that is your candidate. Sync clients, clipboard managers, menu bar utilities, older third-party preference panes, and apps that have run for weeks without a restart are the usual repeat offenders. Quit suspects one at a time and watch whether distnoted settles.

If nothing obvious appears, restart the Mac, which clears loops accumulated over long uptime and resolves a good share of cases. If the behaviour returns and you can tie it to a specific app, check for an update to it. What is not worth doing is trying to disable or block distnoted itself. Inter-process notifications are required for ordinary operation, macOS will bring it back, and you would be treating the messenger instead of the sender.

The anxiety here is not really about the daemon. It is that Activity Monitor shows a long list of processes with cryptic names and no way to tell which of them ever touch the network. Everything looks equally suspicious, so an unfamiliar name becomes a question mark, and the question mark becomes an afternoon of searching.

The distinction that resolves this is simple once you can see it. Most of what runs on a Mac is local: daemons like distnoted that shuttle messages between processes, index files, manage windows, or handle audio. They never open a socket. A much smaller set genuinely does connect out, and that smaller set is the one worth attention. Separating the two turns a wall of unfamiliar names into a short, reviewable list.

NetMute is built for that separation. It shows real-time per-app and per-process network activity, so you can see which processes actually make outbound connections and which domains they reach, with logging you can look back over. Processes with no network dimension, distnoted among them, simply do not show up as network activity, which is itself the answer to the question that brought you here. For the ones that do connect, NetMute includes a per-app firewall with one-click blocking and temporary rules that expire on their own.

To be clear about scope: none of this applies to distnoted. It is not something NetMute blocks or manages, because it has no network side to manage. The value runs the other way. Once you can see the processes that genuinely talk to the internet, you can stop worrying about the many that do not. NetMute is free to download on the Mac App Store, and Premium is a single in-app purchase with no subscription.