# DHCP option 252 for WPAD: who reads it and how to set it

Source: https://findproxyforurl.net/articles/wpad-dhcp-option-252/ · last updated 2026-10-13

DHCP option 252 hands the PAC URL to a client together with its IP address. Only some clients read it, Windows above all, while Chrome, Edge and Firefox on macOS and Linux ignore it. The option is a plain text string with the full URL. This page shows who reads it, how to set it on four DHCP servers and how to check what a client received.

WPAD, the Web Proxy Auto-Discovery Protocol, lets a client find its PAC file (proxy auto-configuration
file) without configuration. The [WPAD page](https://findproxyforurl.net/wpad/) explains the protocol, and the hub page
[WPAD not loading](https://findproxyforurl.net/articles/wpad-not-working/) goes through all checks in order. This page covers the
DHCP part only.

## Only some clients read option 252

DHCP is the protocol that hands out IP addresses when a device joins a network. The WPAD draft from 1999
reserved the DHCP option number 252 for the PAC URL. A client that reads it tries DHCP first and the DNS
name `wpad` second.

| Client | Reads option 252 | Source |
|---|---|---|
| Windows programs that use WinHTTP or WinINet, including Windows services | yes, before DNS | doc, [Microsoft: AutoProxy issues in WinHTTP](https://learn.microsoft.com/en-us/windows/win32/winhttp/autoproxy-issues-in-winhttp) |
| Chrome and Edge on Windows and ChromeOS | yes | code, [url_request_context_builder_mojo.cc](https://chromium.googlesource.com/chromium/src/+/main/services/network/url_request_context_builder_mojo.cc) |
| Chrome and Edge on macOS and Linux | no, DNS only | code, as above |
| Firefox on Windows, since Firefox 63 | yes, with the preference `network.proxy.enable_wpad_over_dhcp` (default `true`) | code, [nsPACMan.cpp](https://searchfox.org/mozilla-central/source/netwerk/base/nsPACMan.cpp) and [bug 356831](https://bugzilla.mozilla.org/show_bug.cgi?id=356831) |
| Firefox on macOS and Linux | no, DNS only | code, as above |
| macOS, when the proxy is set to automatic without a URL | yes | doc, [Apple: proxy settings for device management](https://support.apple.com/guide/deployment/depb78836926/web) |

Microsoft writes: "WinHTTP uses DHCP first, in accordance with the WPAD specification. If no PAC URL is
discovered by issuing a DHCP request, then WinHTTP tries to locate the PAC file at a well-known DNS
address." In Chromium, only Windows and ChromeOS get a DHCP fetcher; every other platform gets one that does
nothing. Firefox's DHCP client is built only for Windows. Apple writes for macOS that "the device requests
the wpad.dat file using DHCP (using a 252 entry) or DNS (using an A Record with the name WPAD)". All sources
were checked on 2026-10-13.

**What follows:** a network that publishes the PAC URL only through DHCP works for Windows, but the browsers
on macOS and Linux never find it. Publish the DNS name `wpad` as well
([the wpad DNS record](https://findproxyforurl.net/articles/wpad-dns-record/)), or better, set the PAC URL explicitly.

## The option is a text string with the full URL

Option 252 carries one string: the complete URL of the PAC file, for example
`http://wpad.corp.example/wpad.dat`. Unlike DNS discovery, the URL from DHCP may use any host, path, port
and `https`. Define the option with the type *string* (Windows), *text* (ISC dhcpd) or *string* (Kea).

**The trailing NUL.** Some guides say the string must end with a NUL character (a zero byte), others say it
must not. Nothing in the vendor documentation requires either. Chromium's code says why both occur: "Some
DHCP servers appear to count the trailing NULL in nBytesData, others do not." It therefore cuts the string at
the first NUL and removes trailing white space (source: code,
[dhcp_pac_file_adapter_fetcher_win.cc](https://chromium.googlesource.com/chromium/src/+/main/net/proxy_resolution/win/dhcp_pac_file_adapter_fetcher_win.cc),
checked 2026-10-13). Kea "silently discards any terminating/trailing nulls" from string options it receives
(source: doc, [Kea DHCPv4 manual](https://kea.readthedocs.io/en/latest/arm/dhcp4-srv.html#custom-dhcpv4-options),
checked 2026-10-13). Set the plain URL without a NUL.

## Setting option 252 on Windows DHCP

If option 252 is not yet defined on the server, define it once, then set the value for the whole server
or for one scope:

```powershell
Add-DhcpServerv4OptionDefinition -Name "WPAD" -OptionId 252 -Type String
# for one scope:
Set-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -OptionId 252 -Value "http://wpad.corp.example/wpad.dat"
# for the whole server: leave out -ScopeId
Set-DhcpServerv4OptionValue -OptionId 252 -Value "http://wpad.corp.example/wpad.dat"
```

`Set-DhcpServerv4OptionValue` also has a parameter `-Wpad` for the same value. "If you specify neither the
ScopeId nor ReservedIP parameter, the option values are set at the server level" (source: doc,
[Add-DhcpServerv4OptionDefinition](https://learn.microsoft.com/en-us/powershell/module/dhcpserver/add-dhcpserverv4optiondefinition)
and [Set-DhcpServerv4OptionValue](https://learn.microsoft.com/en-us/powershell/module/dhcpserver/set-dhcpserverv4optionvalue),
checked 2026-10-13). To see what a scope hands out, run
`Get-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -OptionId 252`.

## Setting option 252 on ISC dhcpd

ISC dhcpd has no name for option 252, so you declare one with the type `text` and then set it:

```text
option wpad-url code 252 = text;

subnet 10.0.0.0 netmask 255.255.255.0 {
  option wpad-url "http://wpad.corp.example/wpad.dat";
}
```

The man page describes the type: "An option whose type is text will encode an ASCII text string" (source:
doc, [dhcp-options(5), "Defining new options"](https://github.com/isc-projects/dhcp/blob/master/common/dhcp-options.5),
checked 2026-10-13). ISC has ended maintenance of dhcpd; Kea is its successor.

## Setting option 252 on Kea

Kea also needs a definition first (`option-def`), then the value (`option-data`), in the `Dhcp4` section:

```json
"option-def": [
  { "name": "wpad", "code": 252, "type": "string", "space": "dhcp4" }
],
"option-data": [
  { "name": "wpad", "code": 252, "space": "dhcp4", "data": "http://wpad.corp.example/wpad.dat" }
]
```

Put `option-data` into a subnet instead of the global section to set it for one subnet only (source: doc,
[Kea DHCPv4 manual, custom options](https://kea.readthedocs.io/en/latest/arm/dhcp4-srv.html#custom-dhcpv4-options),
checked 2026-10-13).

## Setting option 252 on dnsmasq

dnsmasq takes the option number directly. Quote the URL so that it is sent as a string:

```text
dhcp-option=252,"http://wpad.corp.example/wpad.dat"
```

The example configuration of dnsmasq also shows an empty option, `dhcp-option=252,"\n"`, with the comment
"Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave." The same file shows
`dhcp-name-match=set:wpad-ignore,wpad` with `dhcp-ignore-names=tag:wpad-ignore`, which stops a device that
calls itself `wpad` from getting that name in dnsmasq's DNS (source: code,
[dnsmasq.conf.example](https://github.com/imp/dnsmasq/blob/master/dnsmasq.conf.example), checked 2026-10-13).

## Checking what the client received

- **macOS:** `ipconfig getoption en0 252` prints the option from the current lease; use your interface name.
  `ipconfig getpacket en0` prints the whole DHCP answer (source: code,
  [Apple ipconfig man page](https://github.com/apple-oss-distributions/bootp/blob/main/ipconfig.tproj/ipconfig.8),
  checked 2026-10-13).
- **Windows:** there is no built-in command that shows option 252. Capture the DHCP traffic with Wireshark
  and the display filter `dhcp.option.type == 252` while you renew the address (`ipconfig /renew`), or run
  the [diagnosis script for Windows](https://findproxyforurl.net/tools/wpad-diag.ps1).
- **Linux:** no browser reads the option, so there is nothing to check on the client.

A good answer is the exact URL. Then fetch that URL from the same client, as the hub page shows in the check
of the HTTP answer.

## Option 252 is not authenticated

Any device that answers DHCP on the same network segment can hand out its own PAC URL, and with it a proxy of
its choice for all web traffic ([PAC-D008](https://findproxyforurl.net/rules/dhcp-option-252/)). Use DHCP snooping on the switches where
you rely on the option, and prefer an explicit PAC URL set by policy on managed devices, as the page on
[automatic proxy detection](https://findproxyforurl.net/wpad/auto-detect/) describes.


## Frequently asked questions

### What is DHCP option 252?

It is the DHCP option that the WPAD draft reserved for the URL of the PAC file, for example http://wpad.corp.example/wpad.dat. A client with automatic proxy detection switched on asks DHCP for it before it tries the DNS name wpad.

### Which clients read DHCP option 252?

Windows programs that use WinHTTP or WinINet, Chrome and Edge on Windows and ChromeOS, and Firefox on Windows since version 63. Apple documents that macOS asks for it too. Chrome, Edge and Firefox on macOS and Linux do not read it and only look up the DNS name wpad.

### Does the option 252 string need a trailing NUL character?

Nothing in the documentation requires one. Chromium's code says that some DHCP servers count a trailing NUL and others do not, and it cuts the string at the first NUL and removes trailing white space, so both forms work there. Kea removes trailing NULs from string options it receives. Set the plain URL without a NUL.

### How do I set option 252 on a Windows DHCP server?

Define the option once with Add-DhcpServerv4OptionDefinition -Name WPAD -OptionId 252 -Type String, then set the URL with Set-DhcpServerv4OptionValue -OptionId 252 -Value "http://wpad.corp.example/wpad.dat", adding -ScopeId for a single scope. Without -ScopeId the value applies to the whole server.

### Why does Firefox ignore my DHCP option 252?

Firefox reads option 252 only on Windows, and only with "Auto-detect proxy settings for this network" selected. With the default "Use system proxy settings" it does not run its own discovery unless the preference network.proxy.system_wpad is true.