WPAD not working: wpad.dat not found or not used
With automatic proxy detection, a client looks for its PAC file on the network. When nothing happens, one of five steps failed. The switch is off, the client does not find the name, the server does not answer correctly, the file fails, or an old copy is still in use.
The usual causes at a glance
| What you see | Likely cause | Check or fix |
|---|---|---|
| Nothing happens at all | Automatic detection is switched off | The switch in each system (automatic proxy detection) |
nslookup wpad finds nothing | No DNS record for wpad in the client’s DNS suffix | Create the record on your own DNS server |
| Windows finds the file, browsers on macOS or Linux do not | The URL is only in DHCP option 252, which browsers read only on Windows | Publish the DNS name wpad too |
| The name resolves, but the file is not found | Wrong path, port or scheme | curl -sS -D - http://wpad.corp.example/wpad.dat must answer with status 200 |
| The file is found, but traffic goes direct | The script fails or returns nothing | Paste the file into the tester |
| A change does not take effect | Clients keep the old copy | Send Cache-Control: max-age=… and restart the client |
WPAD, the Web Proxy Auto-Discovery Protocol, lets a client find the address of its PAC file (proxy auto-configuration file) without configuration. The WPAD page explains the protocol and its risks. This page goes through the checks when it does not work, in the order a client tries them.
1. Automatic detection must be switched on
Discovery only runs when “Automatically detect settings” (Windows, Chrome, Edge) or “Auto-detect proxy settings for this network” (Firefox) is on. A policy may switch it off. The page automatic proxy detection shows where the switch is in each system.
2. The client must find the PAC URL
The client asks DHCP for option 252 first, then looks up the DNS name wpad. The clients differ:
| Client | DHCP option 252 | DNS name wpad |
|---|---|---|
| Windows (system settings, WinHTTP) | yes, first | yes |
| Chrome, Edge, Firefox | Windows only | yes |
| macOS | yes | yes |
Sources and details are in the table on the WPAD page. A setup that publishes the URL only in DHCP is therefore not found by the browsers on macOS and Linux.
On the client, check what the name resolves to, for example with nslookup wpad. The answer must come
from your own DNS server and point to your web server. The browsers ask only for the single name wpad
and leave it to the operating system to add the DNS suffixes; on Windows, the parent domains may be
tried as well (PAC-D007). Windows programs that use WinHTTP report
ERROR_WINHTTP_AUTODETECTION_FAILED (12180) when no PAC URL is found (source: doc,
Microsoft WinHTTP error messages,
checked 2026-10-11).
3. The server must answer at the fixed address
For DNS discovery the client fetches http://wpad.<domain>/wpad.dat: plain HTTP, port 80 and the file
name wpad.dat are fixed. A file that is only reachable over HTTPS or under another name is not found.
Fetch it the way a client does:
curl -sS -D - http://wpad.corp.example/wpad.dat
The answer must be status 200 with the file, not a redirect or a login page
(PAC-D010), with the content type application/x-ns-proxy-autoconfig
(PAC-D002). A web server that has no entry for .dat files often sends
application/octet-stream or an error page.
4. The file must run in every client
A wpad.dat is an ordinary PAC file. Paste it into the online PAC file tester and press
Check: a syntax error, a missing return or newer JavaScript that Windows rejects make clients go
direct without a message (PAC-E001, PAC-X001,
PAC-K020). Under Delivery, choose “WPAD DNS discovery” or “DHCP option 252”
and paste the response headers from step 3; the tester then grades the delivery too.
5. Clients may still use an old copy
Clients keep the file for a while, and Windows also remembers the result of discovery (expert). Send an explicit
Cache-Control: max-age=… (PAC-D003) and restart the client or the
browser after a change while you test.
When discovery works but the wrong proxy is used
Then the problem is in the file itself. The PAC file troubleshooting page sorts the causes by symptom, and the pages PAC file not working in Chrome or Edge and Proxy.pac ignored on Windows 11 cover the browser and the Windows side.
Frequently asked questions
Why is wpad.dat not found?
The client looks for the PAC URL in DHCP option 252 and by a DNS lookup of the name wpad in its own DNS suffix search list. If neither gives an answer, there is no PAC file. Check on the client that the name wpad resolves to your server and that http://wpad.<domain>/wpad.dat answers with status 200.
Does Chrome use DHCP option 252?
Only on Windows. Chrome, Edge and Firefox look up the DNS name wpad on every system, but they ask DHCP for option 252 only on Windows. On macOS and Linux a DHCP-only setup is not found by the browsers.
Which URL does WPAD fetch?
For DNS discovery the client fetches http://wpad.<domain>/wpad.dat over plain HTTP on port 80. The file name wpad.dat and the path are fixed; a file at another name or only over HTTPS is not found.
Is WPAD safe?
Only with care. Discovery uses plain HTTP and an unauthenticated DHCP option, and a lookup that leaves your DNS namespace can reach a name someone else owns. Prefer setting the PAC URL explicitly through policy and serving it over HTTPS.