FindProxyForURL Beta

wpad.dat generator: create the file for WPAD discovery

A wpad.dat is a PAC file under the name that automatic proxy discovery asks for. This page builds the file and explains where to put it, so that clients that look for a proxy on their own find it.

Create a wpad.dat in three steps

  1. List your proxies in the order clients should try them.
  2. List what goes direct: internal domains, single hosts and your own networks, each with a comment after # if you like.
  3. Download wpad.dat and test it in the checker before you put it on the server.

The content is the same as in a proxy.pac. Only the name and the place where the file is served differ, and that is what the rest of this page is about.

Enter your proxies in failover order and the destinations that must not use them. Every line may carry a comment after #; it ends up next to the entry in the generated file, so the next person knows why it is there. The file is built in your browser; nothing is sent anywhere until you open it in the checker.
Proxies

One per line: [PROXY|HTTPS|SOCKS5] host:port, then an optional # comment. PROXY is the default type. Clients try the entries top to bottom and move on when a proxy does not answer.

    Written above the final return statement, the line that decides every request nothing else matched.

      Lowers the grade unless "Accept fail-open" is ticked in the checker settings. A proxy.pac is for routing, not for security: with this option, clients bypass the proxy whenever it is down, so the firewall must decide whether that is allowed. See direct-fallback-in-proxy-list.

        Direct hosts and domains

        One per line. A name (wiki.partner.example) matches exactly that host; a name with a leading dot (.corp.example) matches the domain itself and every subdomain. No wildcards, no IP addresses (those go in the networks list).

            Direct networks

            IPv4 networks in CIDR notation, one per line (a bare address means /32). The network address must be aligned (10.20.0.0/16, not 10.20.1.0/16). They apply to IP-literal URLs only: the file never resolves a host name to compare it with a network, because that DNS lookup would block every request. See isinnet-on-hostname, dns-function-on-hot-path.

                Options

                Host names are case-insensitive, string comparisons are not. See host-not-lowercased.

                  Cheap and usually right inside a company network; a mistyped public name then fails locally instead of at the proxy. See plain-hostname-blanket-direct.

                    10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8 and 169.254.0.0/16, for IP-literal URLs only.

                      Bypass presets

                      Identity-provider traffic that must not depend on proxy authentication (avoids sign-in loops).

                            File header

                            Optional lines at the top of the file (owner, change reference). Plain ASCII, no personal data needed.

                              Generated wpad.dat

                              Where clients look for wpad.dat

                              WPAD (Web Proxy Auto-Discovery) is the procedure behind the setting “Automatically detect settings”. It comes from an IETF draft that never became a standard, so clients implement it slightly differently, but the two ways of finding the file are the same everywhere:

                              1. DHCP option 252. The client asks the DHCP server for option 252, which contains the full URL of the file, for example http://wpad.corp.example/wpad.dat. With DHCP the URL can point to any server and any name; using wpad.dat anyway keeps both ways consistent.
                              2. The DNS lookup for wpad. Without an answer from DHCP, the client looks up a host called wpad and fetches http://wpad/wpad.dat. The operating system appends its DNS suffixes to that name. On Windows this can include parent domains (DNS devolution), for example from eng.corp.example to wpad.corp.example, and it applies to browsers too, because they use the Windows resolver. A name outside your organisation must never answer, which is why you should own a wpad record in every internal DNS suffix. WPAD and wpad.dat shows which client does what, and Web proxy auto-detection explains the “Automatically detect settings” switch in Windows, macOS and the browsers.

                              Serve the file at the web root, over HTTP

                              For the DNS way, the file must be reachable as exactly http://wpad.<your domain>/wpad.dat:

                              • a DNS record wpad in each internal DNS suffix, pointing at your web server,
                              • the file in the web root of that server, named wpad.dat in lower case,
                              • plain HTTP on port 80, because discovery does not use HTTPS,
                              • the content type application/x-ns-proxy-autoconfig and a short cache lifetime such as Cache-Control: max-age=3600.

                              Most web servers do not know the .dat extension. On Apache, set the type for this one file:

                              # Header needs mod_headers
<Files "wpad.dat">
    ForceType application/x-ns-proxy-autoconfig
    Header set Cache-Control "max-age=3600"
</Files>

                              On nginx, do the same in a location for the file:

                              location = /wpad.dat {
    types { }
    default_type application/x-ns-proxy-autoconfig;
    add_header Cache-Control "max-age=3600";
}

                              On IIS, add a MIME type for .dat with the value application/x-ns-proxy-autoconfig; IIS does not serve files whose extension has no MIME type.

                              Then test the delivery: paste the output of curl -sI http://wpad.corp.example/wpad.dat into the checker under “Delivery” and choose “WPAD DNS discovery” or “DHCP option 252”.

                              Use discovery only where you cannot configure clients

                              Plain HTTP and unauthenticated DHCP mean that anyone who can answer first can hand out their own file and with it route all web traffic. On managed devices, set the file’s URL through group policy or MDM and serve it over HTTPS instead; the PAC file generator lists where that setting is on Windows, macOS and in the browsers. The WPAD page covers the risks and how to keep discovery safe, and wpad.dat vs proxy.pac compares the two ways of delivering the file.

                              Test the file before clients find it

                              Clients that use discovery pick up a new wpad.dat without anyone noticing, so a mistake reaches every one of them. Open the file in the checker first, and try it on a test client before you replace the file on the server. Ready-made files for common cases are on the PAC file examples page; any of them works as a wpad.dat.

                              Frequently asked questions

                              What is a wpad.dat file?

                              A PAC file, a small JavaScript file with a FindProxyForURL function, saved under the name wpad.dat. That is the name clients ask for when they look for a proxy configuration on their own through WPAD.

                              Where do I put the wpad.dat file?

                              In the web root of a server that answers as wpad.<your DNS suffix>, so that it is reachable as http://wpad.corp.example/wpad.dat. If you use DHCP option 252, the option contains the file's full URL instead.

                              Which MIME type does wpad.dat need?

                              application/x-ns-proxy-autoconfig. Web servers usually do not know the .dat extension, so set the type for the file explicitly; IIS does not serve the file at all until a MIME type for .dat exists.

                              Can wpad.dat be served over HTTPS?

                              Not for DNS discovery, which always asks for http://wpad.<suffix>/wpad.dat. A PAC file URL that you configure explicitly, for example by group policy, can and should use HTTPS.

                              Is wpad.dat the same as proxy.pac?

                              Yes, in content. You can serve the same file under both names, as wpad.dat for discovery and as proxy.pac for clients that have the URL configured.