# The wpad DNS record: A or CNAME, the block list and the suffix list Source: https://findproxyforurl.net/articles/wpad-dns-record/ ยท last updated 2026-10-13 A wpad record must exist under every DNS suffix your clients use, and it may be an A record or a CNAME. On a Windows DNS server it also has to get past the global query block list, which answers "no such name" for wpad even when the record exists. This page explains which names clients ask for, how to read and change the block list, and why a wpad lookup must never leave your own namespace. WPAD, the Web Proxy Auto-Discovery Protocol, lets a client find its PAC file (proxy auto-configuration file) without configuration. The [WPAD page](https://findproxyforurl.net/wpad/) explains the protocol, and the hub page [WPAD not loading](https://findproxyforurl.net/articles/wpad-not-working/) goes through all checks in order. This page covers the DNS part: the record, the names clients ask for, and what can block or misdirect the lookup. ## The browsers ask for the single name wpad Chrome, Edge and Firefox fetch the fixed address `http://wpad/wpad.dat`. Chromium's source says why: "we directly resolve "wpad", and let the operating system apply the DNS suffix search paths. This is the same approach taken by Firefox" (source: code, [pac_file_decider.cc](https://chromium.googlesource.com/chromium/src/+/main/net/proxy_resolution/pac_file_decider.cc) and [nsPACMan.cpp](https://searchfox.org/mozilla-central/source/netwerk/base/nsPACMan.cpp), checked 2026-10-13). The operating system turns `wpad` into full names such as `wpad.corp.example` by adding its DNS suffixes, so the record must exist under every suffix your clients use. Check on the client: ```bat nslookup wpad ipconfig /all ``` `ipconfig /all` lists the "DNS Suffix Search List" and the suffix of each connection. On macOS, `scutil --dns` shows the search domains; on Linux, `resolvectl status` does. ## A record or CNAME: both work The client's resolver follows a CNAME to the address, so either form finds the server. Microsoft's guide for its former proxy server product set it up as an A record for the web server and a CNAME named `wpad` pointing to it (source: doc, [Microsoft TechNet archive: configure a WPAD entry in DNS](https://learn.microsoft.com/en-us/previous-versions/tn-archive/cc995062(v=technet.10)), checked 2026-10-13). No vendor documentation describes any other difference between the two. What does matter is the web server's name. The browsers request `http://wpad/wpad.dat`, so they send the host name `wpad` in the request, not the name the CNAME points to. Make the web server answer for `wpad` and for `wpad.`, for example as the default site or with extra server names, and check it with `curl -sS -D - http://wpad.corp.example/wpad.dat`. ## A Windows DNS server blocks wpad by default Windows DNS servers have a *global query block list*: a list of names that the server refuses to resolve in every zone it hosts. "By default, the block list contains entries for wpad and isatap." For a blocked name "the DNS server replies to the query as though no resource record existed, even if there is a host (A or AAAA) resource record in the zone for the name" (source: doc, [Microsoft: Remove a name from the global query block list](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee649250(v=ws.10)) and [DNS server global query block list](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff807393(v=ws.10)), checked 2026-10-13). This is the most common reason why a correct wpad record does not resolve. **Read the list:** ```bat dnscmd /info /globalqueryblocklist ``` In PowerShell: `Get-DnsServerGlobalQueryBlockList`. **Change the list.** The command replaces every name in the list with the names you give; "if you do not specify a name, all names are removed". To unblock `wpad` and keep `isatap` blocked: ```bat dnscmd /config /globalqueryblocklist isatap ``` In PowerShell: `Set-DnsServerGlobalQueryBlockList -List isatap` (source: doc, [Set-DnsServerGlobalQueryBlockList](https://learn.microsoft.com/en-us/powershell/module/dnsserver/set-dnsserverglobalqueryblocklist), checked 2026-10-13). **Switch the list off** entirely, which also unblocks `isatap`: ```bat dnscmd /config /enableglobalqueryblocklist 0 ``` The list "is a per-server setting and is not replicated between servers", so change it on every DNS server that clients ask. Microsoft also notes that the DNS Server service removes `wpad` from the list when it starts for the first time and finds a `wpad` record in an existing zone; this is why some servers do not block it. ## Windows decides which wpad names are tried The Windows DNS client builds the names from its suffix settings (source: doc, [Microsoft: DNS devolution](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee683928(v=ws.10)), checked 2026-10-13): - **With a DNS suffix search list,** it tries `wpad.` plus each entry of the list, in order. "When you configure a suffix search list, devolution is disabled and the suffix search list is used instead." - **Without a search list,** it tries the primary DNS suffix of the computer and the suffix of the network connection. *DNS devolution* may then add parent domains of the primary suffix. In an Active Directory domain it stops at the forest root domain, the top domain of the forest. We measured this on Windows 11 25H2 (source: lab, 2026-10-11). With a search list of two suffixes, Windows asked only for `wpad.` plus each of the two, and nothing else. Without a search list, it asked for the primary suffix first and the connection suffix second. When neither name existed, it then also asked the local network segment, through mDNS for `wpad.local`, through NetBIOS for `WPAD` and through LLMNR for `wpad`. Any device on the same segment can answer those questions. **What follows:** publish the record under every suffix your clients use, including the suffix that a VPN connection adds. Where you do not use WPAD, a record that answers on purpose, or a deliberate "no such name" from your own DNS server, keeps the question inside your network. LLMNR and NetBIOS name resolution can be switched off by policy; CISA describes how ([CISA: disable LLMNR](https://www.cisa.gov/eviction-strategies-tool/info-countermeasures/CM0053)). ## Clients that use a public DNS server never find your record A client that asks a public DNS server, or the DNS server of a home router, gets no answer for `wpad.corp.example` if that name exists only on your internal DNS servers. Laptops outside the office are the common case: their wpad lookup either fails or goes to the internet. A setup that relies on WPAD only works where the client asks your own DNS servers, which on the road means only with the VPN connected. ## A lookup that leaves your namespace can be answered by anyone If a client asks for `wpad` under a domain that you do not own, whoever owns that name can answer, hand out a PAC file and send the client's web traffic through a proxy of their choice. The US alert of 2016 warned that "leaked WPAD queries could result in domain name collisions with internal network naming schemes" (source: doc, [CISA: WPAD name collision vulnerability](https://www.cisa.gov/news-events/alerts/2016/05/23/wpad-name-collision-vulnerability)). The rule [PAC-D007](https://findproxyforurl.net/rules/wpad-dns-discovery/) describes the attack. - Use only DNS suffixes under a domain you own. - Make sure that every `wpad.` name your clients can ask for exists on your servers, or is answered with "no such name" by them. - Block questions for `wpad.*` to the internet at your resolvers and firewall. - Where you can, set the PAC URL explicitly and switch auto-detection off, as the page on [automatic proxy detection](https://findproxyforurl.net/wpad/auto-detect/) describes. ## Frequently asked questions ### Should the wpad record be an A record or a CNAME? Both work. The client's resolver follows a CNAME to the address. Microsoft's old proxy server guide recommends an A record for the web server and a CNAME named wpad that points to it. Whichever you use, the web server must answer for the host name wpad, because the browsers fetch http://wpad/wpad.dat. ### Why does nslookup wpad fail although the record exists? On a Windows DNS server the global query block list contains wpad and isatap by default. The server then answers as though no record existed, even when there is one in the zone. Read the list with dnscmd /info /globalqueryblocklist and remove wpad on every DNS server that clients ask. ### How do I remove wpad from the global query block list? Run dnscmd /config /globalqueryblocklist isatap on each DNS server. The command replaces the whole list with the names you give, so this keeps isatap blocked and removes wpad. In PowerShell the same is Set-DnsServerGlobalQueryBlockList -List isatap. To switch the list off entirely, run dnscmd /config /enableglobalqueryblocklist 0. ### Which wpad names does Windows look up? The DNS client adds each suffix from the suffix search list to the name wpad. Without a search list it uses the primary DNS suffix and the suffix of the network connection, and DNS devolution may add parent domains down to the forest root. In our measurements Windows 11 also asked mDNS, NetBIOS and LLMNR for wpad when DNS had no answer. ### Is a wpad DNS record dangerous? Your own record is not; a lookup that leaves your namespace is. If a client asks for wpad under a domain you do not own, whoever owns that name can hand out a PAC file and see or redirect the client's web traffic. Own every wpad name under your suffixes and block wpad lookups to the internet at your resolvers.