# WPAD not working: wpad.dat not found or not used

Source: https://findproxyforurl.net/articles/wpad-not-working/ · last updated 2026-10-12

With automatic proxy detection, a client looks for its PAC file on the network. When nothing happens, one of five steps failed. The switch is off, the client does not find the name, the server does not answer correctly, the file fails, or an old copy is still in use.

## The usual causes at a glance

| What you see | Likely cause | Check or fix |
|---|---|---|
| Nothing happens at all | Automatic detection is switched off | The switch in each system ([automatic proxy detection](https://findproxyforurl.net/wpad/auto-detect/)) |
| `nslookup wpad` finds nothing | No DNS record for `wpad` in the client's DNS suffix | Create the record on your own DNS server |
| Windows finds the file, browsers on macOS or Linux do not | The URL is only in DHCP option 252, which browsers read only on Windows | Publish the DNS name `wpad` too |
| The name resolves, but the file is not found | Wrong path, port or scheme | `curl -sS -D - http://wpad.corp.example/wpad.dat` must answer with status 200 |
| The file is found, but traffic goes direct | The script fails or returns nothing | Paste the file into the [tester](https://findproxyforurl.net/check/) |
| A change does not take effect | Clients keep the old copy | Send `Cache-Control: max-age=…` and restart the client |

WPAD, the Web Proxy Auto-Discovery Protocol, lets a client find the address of its PAC file (proxy
auto-configuration file) without configuration. The [WPAD page](https://findproxyforurl.net/wpad/) explains the protocol and its
risks. This page goes through the checks when it does not work, in the order a client tries them.

## 1. Automatic detection must be switched on

Discovery only runs when "Automatically detect settings" (Windows, Chrome, Edge) or "Auto-detect proxy
settings for this network" (Firefox) is on. A policy may switch it off. The page
[automatic proxy detection](https://findproxyforurl.net/wpad/auto-detect/) shows where the switch is in each system.

## 2. The client must find the PAC URL

The client asks DHCP for option 252 first, then looks up the DNS name `wpad`. The clients differ:

| Client | DHCP option 252 | DNS name `wpad` |
|---|---|---|
| Windows (system settings, WinHTTP) | yes, first | yes |
| Chrome, Edge, Firefox | Windows only | yes |
| macOS | yes | yes |

Sources and details are in the table on the [WPAD page](https://findproxyforurl.net/wpad/). A setup that publishes the URL only in
DHCP is therefore not found by the browsers on macOS and Linux.

On the client, check what the name resolves to, for example with `nslookup wpad`. The answer must come
from your own DNS server and point to your web server. The browsers ask only for the single name `wpad`
and leave it to the operating system to add the DNS suffixes; on Windows, the parent domains may be
tried as well ([PAC-D007](https://findproxyforurl.net/rules/wpad-dns-discovery/)). Windows programs that use WinHTTP report
`ERROR_WINHTTP_AUTODETECTION_FAILED` (12180) when no PAC URL is found (source: doc,
[Microsoft WinHTTP error messages](https://learn.microsoft.com/en-us/windows/win32/winhttp/error-messages),
checked 2026-10-11).

## 3. The server must answer at the fixed address

For DNS discovery the client fetches `http://wpad.<domain>/wpad.dat`: plain HTTP, port 80 and the file
name `wpad.dat` are fixed. A file that is only reachable over HTTPS or under another name is not found.
Fetch it the way a client does:

```sh
curl -sS -D - http://wpad.corp.example/wpad.dat
```

The answer must be status 200 with the file, not a redirect or a login page
([PAC-D010](https://findproxyforurl.net/rules/http-error-status/)), with the content type `application/x-ns-proxy-autoconfig`
([PAC-D002](https://findproxyforurl.net/rules/wrong-content-type/)). A web server that has no entry for `.dat` files often sends
`application/octet-stream` or an error page.

## 4. The file must run in every client

A wpad.dat is an ordinary PAC file. Paste it into the [online PAC file tester](https://findproxyforurl.net/check/) and press
**Check**: a syntax error, a missing `return` or newer JavaScript that Windows rejects make clients go
direct without a message ([PAC-E001](https://findproxyforurl.net/rules/syntax-error/), [PAC-X001](https://findproxyforurl.net/rules/no-default-return/),
[PAC-K020](https://findproxyforurl.net/rules/es2018-syntax/)). Under **Delivery**, choose "WPAD DNS discovery" or "DHCP option 252"
and paste the response headers from step 3; the tester then grades the delivery too.

## 5. Clients may still use an old copy

Clients keep the file for a while, and Windows also remembers the result of discovery *(expert)*. Send an explicit
`Cache-Control: max-age=…` ([PAC-D003](https://findproxyforurl.net/rules/missing-cache-control/)) and restart the client or the
browser after a change while you test.

## When discovery works but the wrong proxy is used

Then the problem is in the file itself. The [PAC file troubleshooting](https://findproxyforurl.net/articles/pac-file-troubleshooting/)
page sorts the causes by symptom, and the pages
[PAC file not working in Chrome or Edge](https://findproxyforurl.net/articles/pac-file-not-working-chrome-edge/) and
[Proxy.pac ignored on Windows 11](https://findproxyforurl.net/articles/pac-file-ignored-windows-11/) cover the browser and the
Windows side.


## Frequently asked questions

### Why is wpad.dat not found?

The client looks for the PAC URL in DHCP option 252 and by a DNS lookup of the name wpad in its own DNS suffix search list. If neither gives an answer, there is no PAC file. Check on the client that the name wpad resolves to your server and that http://wpad.<domain>/wpad.dat answers with status 200.

### Does Chrome use DHCP option 252?

Only on Windows. Chrome, Edge and Firefox look up the DNS name wpad on every system, but they ask DHCP for option 252 only on Windows. On macOS and Linux a DHCP-only setup is not found by the browsers.

### Which URL does WPAD fetch?

For DNS discovery the client fetches http://wpad.<domain>/wpad.dat over plain HTTP on port 80. The file name wpad.dat and the path are fixed; a file at another name or only over HTTPS is not found.

### Is WPAD safe?

Only with care. Discovery uses plain HTTP and an unauthenticated DHCP option, and a lookup that leaves your DNS namespace can reach a name someone else owns. Prefer setting the PAC URL explicitly through policy and serving it over HTTPS.