What is Gatekeeper?
Gatekeeper decides whether a Mac will open an app the first time the user launches it. It does not scan the whole disk or run on a schedule. It checks software that arrived from outside the Mac App Store, such as a .dmg or .pkg from a vendor website, and asks two questions: who built this, and has Apple checked it?
How it works
- Quarantine flag: when a browser, Mail, Messages or another app downloads a file, macOS tags it with a quarantine attribute (
com.apple.quarantine) recording that it came from the internet. That flag is what mainly triggers the first-launch check. - Code signature: the app must be signed with a Developer ID certificate that Apple issued to a registered developer. A broken signature, for example after someone tampered with the app, fails the check.
- Notarization: the developer submits the app to Apple, which runs automated malware checks and issues a ticket. Since macOS Catalina, software distributed outside the App Store generally needs notarization to open without being blocked.
- First-launch decision: if the checks pass, macOS shows a one-time prompt that the app was downloaded from the internet and asks the user to confirm. If they fail, macOS blocks the launch.
The allowed-sources setting
The policy lives in System Settings > Privacy & Security, in the Security section. Current versions offer two choices: apps from the App Store only, or from the App Store plus identified (known) developers. The exact wording varies by version, and older releases kept this setting in System Preferences > Security & Privacy. The old Anywhere choice was removed from the settings screen in macOS Sierra. On managed Macs, an MDM profile can set and lock this policy.
Opening a blocked app safely
When Gatekeeper blocks an app, the message usually says Apple cannot verify the app or its developer, or that the app is damaged and should be moved to the Trash. The damaged message usually means the signature is broken, so delete that copy and download a fresh one from the vendor. For a legitimate in-house or older tool:
- Confirm the source and, if the vendor publishes one, compare the file hash.
- Try to open the app once so macOS records the block.
- Go to System Settings > Privacy & Security, scroll to the Security section and click Open Anyway next to the app's name.
- Authenticate as an administrator and confirm.
Older versions also let users Control-click the app in Finder and choose Open. Apple removed that shortcut in macOS Sequoia, so Privacy & Security is now the standard route. In Terminal, spctl --status reports whether Gatekeeper assessments are enabled. Turning Gatekeeper off for the whole system is not a fix, because it removes the check for every future download.
Gatekeeper and other Mac protections
| Feature | Job |
|---|---|
| Gatekeeper | Checks the developer signature and notarization of downloaded apps before first launch |
| XProtect | Built-in signature-based malware detection; Apple updates its definitions in the background |
| Notarization | Apple's automated scan of software before the developer distributes it |
| System Integrity Protection (SIP) | Stops even the root user from modifying protected system locations |
| App Sandbox | Limits what App Store apps can reach on the system |
The closest Windows equivalent is Microsoft Defender SmartScreen, which warns about unrecognized downloads using the Mark of the Web, much as Gatekeeper uses the quarantine flag. Neither replaces antivirus or user training. A user who types an admin password into a fake installer can still infect a Mac.
Gatekeeper on the CompTIA A+ exam
Gatekeeper maps to Core 2 (220-1202) objective 1.8, macOS features and utilities. Know what it checks (developer signature and notarization), where its setting lives (Privacy & Security in System Settings), and how to allow one trusted app with Open Anyway without disabling protection. If a scenario says a Mac refuses to open an app downloaded from a website and warns about an unverified developer, think Gatekeeper. If it describes known malware being detected and removed in the background, think XProtect.