mdnsnsp.dll: Apple's Bonjour file, an LSA warning, or something to worry about?

What mdnsnsp.dll does and why Windows blocks it

Bonjour is Apple's network discovery service. Printers, speakers and other devices announce themselves on the local network under names that end in .local, and the Bonjour Service, mDNSResponder.exe, listens for them. mdnsnsp.dll is the piece that plugs this into Windows: Bonjour registers it as a namespace provider in Winsock, the Windows networking layer, so that any program asking for a .local name gets an answer from Bonjour.

Because the provider sits in the name lookup path, Windows can load it into many processes, the Local Security Authority among them. On PCs where LSA protection is on, the Local Security Authority runs as a protected process and accepts only plug-ins signed by Microsoft. Apple signs Bonjour with its own certificate, so the protected process refuses mdnsnsp.dll and Windows reports it. Microsoft documents this behaviour and the Code Integrity events it writes: 3033 for a file below the Microsoft signing level, 3063 for one that fails the shared section rules.

So the warning tells you something about a signature, not about intent. It does not say the file is harmful, and it does not say the file is Apple's. That second question is what the checks on this page answer.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of mdnsnsp.dll

Four questions decide it: where the file is, who signed it, what it says about itself, and whether Bonjour is installed at all. A library never shows in Task Manager under its own name, so use these checks.

1. List every copy and where it sits. Copies under Program Files\Bonjour and Program Files (x86)\Bonjour are normal. Look closer at any copy in System32, SysWOW64, Downloads, Temp, AppData or ProgramData.

   Get-ChildItem -Path C:\ -Filter mdnsnsp.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Check the digital signature. Status Valid with an Apple Inc. signer means an unmodified Apple build. NotSigned, HashMismatch or another signer means the file is not Apple's as shipped. Text fields can be copied; a valid signature cannot.

   Get-AuthenticodeSignature "C:\Program Files\Bonjour\mdnsNSP.dll" | Format-List Status, SignerCertificate

3. Read the version resource. Apple's file reports Apple Inc. as the company and Bonjour Namespace Provider as the description. A fake may leave these empty or copy them, so this check alone does not clear a file.

   (Get-Item "C:\Program Files\Bonjour\mdnsNSP.dll").VersionInfo | Format-List CompanyName, FileDescription, FileVersion

4. Confirm that Bonjour is installed. Open Settings, Apps, Installed apps and search for Bonjour. The genuine file comes with that entry and with the Bonjour Service in the Services console. An mdnsnsp.dll on a PC with neither has no installer behind it.

   Get-Service -Name 'Bonjour Service' -ErrorAction SilentlyContinue | Format-List Name, Status, StartType

5. Compare the size and checksum. Use the file check on this page. Apple's copies in the catalogue are about 120 KB to 145 KB. A match identifies a known Apple build; no match is not proof of a fake, because many Bonjour releases are not listed.

A valid Apple signature clears that one file. It does not explain a warning about another module, and it says nothing about other files in unusual folders, which deserve their own checks.

Do you need mdnsnsp.dll?

Windows does not need it. Bonjour needs it, and you need Bonjour only for network discovery: AirPlay speakers, shared iTunes libraries and printers that announce themselves with Bonjour. If you use none of these, removing Bonjour as a whole is supported and ends the LSA warning too.

1. Keep a genuine copy if you use Bonjour's features. A signed Apple copy in the Bonjour folder is fine. The LSA warning does not mean Bonjour stopped working for your normal programs; it only cannot load into the protected Local Security Authority.
2. Uninstall Bonjour, not the DLL. Open Settings, Apps, Installed apps, select Bonjour and choose Uninstall, then restart. Deleting only mdnsnsp.dll can leave Windows networking pointing at a missing file.
3. Leave LSA protection on. Do not switch off Local Security Authority protection in Windows Security to quiet the warning. It guards your sign-in credentials against code injection, and that protection matters more than one Apple plug-in.
4. Scan if a copy failed the checks. Open Windows Security, Virus and threat protection, Scan options, Full scan, and quarantine what it finds. Then run the offline scan, which checks the PC before Windows starts.

   Start-MpWDOScan

5. Check what starts with Windows. After the scan, open Task Manager, Startup apps, and Task Scheduler. Disable entries that run a program from AppData, ProgramData or Temp that you do not recognise.

Warning signs

Known versions of mdnsnsp.dll

A public DLL catalogue lists 4 versions of mdnsnsp.dll, from 1.0.5.11 to 3.1.0.1, by Apple Inc.. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix mdnsnsp.dll errors on uGetFix

Questions people ask