Guide

WPAD auto-discovery

How browsers automatically find your PAC file — and why it can be risky.

Web Proxy Auto-Discovery (WPAD) lets browsers find the PAC file URL automatically using DHCP or DNS, eliminating the need to configure the PAC URL on every client machine. The convention is to name the file wpad.dat (instead of proxy.pac) when using WPAD.

DHCP first: The client sends a DHCP request on startup. If the DHCP server includes Option 252 (WPAD URL), the client uses that URL to fetch the PAC file directly. This is the fastest and most reliable method.

DNS fallback: If DHCP doesn't provide a WPAD URL, the client tries DNS. It constructs candidate URLs by prepending wpad. to the domain: e.g. http://wpad.corp.com/wpad.dat. The first hostname that resolves and serves a valid PAC file wins.

Configure your server: Host wpad.dat at the WPAD URL with MIME type application/x-ns-proxy-autoconfig. Ensure the hostname wpad.yourdomain.com resolves in internal DNS.

Browser settings: Enable "Automatically detect proxy settings" in the browser or OS proxy configuration. On Windows this is under Settings → Network → Proxy → Automatically detect settings.

WPAD is disabled by default in many modern browsers and OS configurations due to security risks (see Security). Consider configuring the PAC URL explicitly via Group Policy or MDM instead of relying on WPAD auto-discovery.