DHCP option 252 for WPAD: who reads it and how to set it

Published 13 October 2026

DHCP option 252 hands the PAC URL to a client together with its IP address. Only some clients read it, Windows above all, while Chrome, Edge and Firefox on macOS and Linux ignore it. The option is a plain text string with the full URL. This page shows who reads it, how to set it on four DHCP servers and how to check what a client received.

WPAD, the Web Proxy Auto-Discovery Protocol, lets a client find its PAC file (proxy auto-configuration file) without configuration. The WPAD page explains the protocol, and the hub page WPAD not loading goes through all checks in order. This page covers the DHCP part only.

Only some clients read option 252

DHCP is the protocol that hands out IP addresses when a device joins a network. The WPAD draft from 1999 reserved the DHCP option number 252 for the PAC URL. A client that reads it tries DHCP first and the DNS name wpad second.

Microsoft writes: “WinHTTP uses DHCP first, in accordance with the WPAD specification. If no PAC URL is discovered by issuing a DHCP request, then WinHTTP tries to locate the PAC file at a well-known DNS address.” In Chromium, only Windows and ChromeOS get a DHCP fetcher; every other platform gets one that does nothing. Firefox’s DHCP client is built only for Windows. Apple writes for macOS that “the device requests the wpad.dat file using DHCP (using a 252 entry) or DNS (using an A Record with the name WPAD)”. All sources were checked on 2026-10-13.

What follows: a network that publishes the PAC URL only through DHCP works for Windows, but the browsers on macOS and Linux never find it. Publish the DNS name wpad as well (the wpad DNS record), or better, set the PAC URL explicitly.

The option is a text string with the full URL

Option 252 carries one string: the complete URL of the PAC file, for example http://wpad.corp.example/wpad.dat. Unlike DNS discovery, the URL from DHCP may use any host, path, port and https. Define the option with the type string (Windows), text (ISC dhcpd) or string (Kea).

The trailing NUL. Some guides say the string must end with a NUL character (a zero byte), others say it must not. Nothing in the vendor documentation requires either. Chromium’s code says why both occur: “Some DHCP servers appear to count the trailing NULL in nBytesData, others do not.” It therefore cuts the string at the first NUL and removes trailing white space (source: code, dhcp_pac_file_adapter_fetcher_win.cc, checked 2026-10-13). Kea “silently discards any terminating/trailing nulls” from string options it receives (source: doc, Kea DHCPv4 manual, checked 2026-10-13). Set the plain URL without a NUL.

Setting option 252 on Windows DHCP

If option 252 is not yet defined on the server, define it once, then set the value for the whole server or for one scope:

Add-DhcpServerv4OptionDefinition -Name "WPAD" -OptionId 252 -Type String
# for one scope:
Set-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -OptionId 252 -Value "http://wpad.corp.example/wpad.dat"
# for the whole server: leave out -ScopeId
Set-DhcpServerv4OptionValue -OptionId 252 -Value "http://wpad.corp.example/wpad.dat"

Set-DhcpServerv4OptionValue also has a parameter -Wpad for the same value. “If you specify neither the ScopeId nor ReservedIP parameter, the option values are set at the server level” (source: doc, Add-DhcpServerv4OptionDefinition and Set-DhcpServerv4OptionValue, checked 2026-10-13). To see what a scope hands out, run Get-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -OptionId 252.

Setting option 252 on ISC dhcpd

ISC dhcpd has no name for option 252, so you declare one with the type text and then set it:

option wpad-url code 252 = text;

subnet 10.0.0.0 netmask 255.255.255.0 {
  option wpad-url "http://wpad.corp.example/wpad.dat";
}

The man page describes the type: “An option whose type is text will encode an ASCII text string” (source: doc, dhcp-options(5), “Defining new options”, checked 2026-10-13). ISC has ended maintenance of dhcpd; Kea is its successor.

Setting option 252 on Kea

Kea also needs a definition first (option-def), then the value (option-data), in the Dhcp4 section:

"option-def": [
  { "name": "wpad", "code": 252, "type": "string", "space": "dhcp4" }
],
"option-data": [
  { "name": "wpad", "code": 252, "space": "dhcp4", "data": "http://wpad.corp.example/wpad.dat" }
]

Put option-data into a subnet instead of the global section to set it for one subnet only (source: doc, Kea DHCPv4 manual, custom options, checked 2026-10-13).

Setting option 252 on dnsmasq

dnsmasq takes the option number directly. Quote the URL so that it is sent as a string:

dhcp-option=252,"http://wpad.corp.example/wpad.dat"

The example configuration of dnsmasq also shows an empty option, dhcp-option=252,"\n", with the comment “Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.” The same file shows dhcp-name-match=set:wpad-ignore,wpad with dhcp-ignore-names=tag:wpad-ignore, which stops a device that calls itself wpad from getting that name in dnsmasq’s DNS (source: code, dnsmasq.conf.example, checked 2026-10-13).

Checking what the client received

• macOS: ipconfig getoption en0 252 prints the option from the current lease; use your interface name. ipconfig getpacket en0 prints the whole DHCP answer (source: code, Apple ipconfig man page, checked 2026-10-13).
• Windows: there is no built-in command that shows option 252. Capture the DHCP traffic with Wireshark and the display filter dhcp.option.type == 252 while you renew the address (ipconfig /renew), or run the diagnosis script for Windows.
• Linux: no browser reads the option, so there is nothing to check on the client.

A good answer is the exact URL. Then fetch that URL from the same client, as the hub page shows in the check of the HTTP answer.

Option 252 is not authenticated

Any device that answers DHCP on the same network segment can hand out its own PAC URL, and with it a proxy of its choice for all web traffic (PAC-D008). Use DHCP snooping on the switches where you rely on the option, and prefer an explicit PAC URL set by policy on managed devices, as the page on automatic proxy detection describes.

Frequently asked questions

What is DHCP option 252?

It is the DHCP option that the WPAD draft reserved for the URL of the PAC file, for example http://wpad.corp.example/wpad.dat. A client with automatic proxy detection switched on asks DHCP for it before it tries the DNS name wpad.

Which clients read DHCP option 252?

Windows programs that use WinHTTP or WinINet, Chrome and Edge on Windows and ChromeOS, and Firefox on Windows since version 63. Apple documents that macOS asks for it too. Chrome, Edge and Firefox on macOS and Linux do not read it and only look up the DNS name wpad.

Does the option 252 string need a trailing NUL character?

Nothing in the documentation requires one. Chromium's code says that some DHCP servers count a trailing NUL and others do not, and it cuts the string at the first NUL and removes trailing white space, so both forms work there. Kea removes trailing NULs from string options it receives. Set the plain URL without a NUL.

How do I set option 252 on a Windows DHCP server?

Define the option once with Add-DhcpServerv4OptionDefinition -Name WPAD -OptionId 252 -Type String, then set the URL with Set-DhcpServerv4OptionValue -OptionId 252 -Value "http://wpad.corp.example/wpad.dat", adding -ScopeId for a single scope. Without -ScopeId the value applies to the whole server.

Why does Firefox ignore my DHCP option 252?

Firefox reads option 252 only on Windows, and only with "Auto-detect proxy settings for this network" selected. With the default "Use system proxy settings" it does not run its own discovery unless the preference network.proxy.system_wpad is true.