# wpad.dat generator: create the file for WPAD discovery

Source: https://findproxyforurl.net/generate/wpad-dat/ · updated 2026-10-10

Changed 2026-10-10: The page now says that on Windows the browsers' DNS lookups of wpad are also subject to DNS devolution, the Windows habit of trying shorter parent domains.

A wpad.dat is a PAC file under the name that automatic proxy discovery asks for. This page builds the file and explains where to put it, so that clients that look for a proxy on their own find it.

## Create a wpad.dat in three steps

1. **List your proxies** in the order clients should try them.
2. **List what goes direct**: internal domains, single hosts and your own networks, each with a
   comment after `#` if you like.
3. **Download wpad.dat and test it** in the checker before you put it on the server.

The content is the same as in a proxy.pac. Only the name and the place where the file is served
differ, and that is what the rest of this page is about.

The form on https://findproxyforurl.net/generate/wpad-dat/ builds the file in the browser.

## Where clients look for wpad.dat

WPAD (Web Proxy Auto-Discovery) is the procedure behind the setting "Automatically detect
settings". It comes from an IETF draft that never became a standard, so clients implement it
slightly differently, but the two ways of finding the file are the same everywhere:

1. **DHCP option 252.** The client asks the DHCP server for option 252, which contains the full
   URL of the file, for example `http://wpad.corp.example/wpad.dat`. With DHCP the URL can point
   to any server and any name; using `wpad.dat` anyway keeps both ways consistent.
2. **The DNS lookup for `wpad`.** Without an answer from DHCP, the client looks up a host called
   `wpad` and fetches `http://wpad/wpad.dat`. The operating system appends its DNS suffixes to
   that name. On Windows this can include parent domains (DNS devolution), for example from
   `eng.corp.example` to `wpad.corp.example`, and it applies to browsers too, because they use the
   Windows resolver. A name outside your organisation must never answer,
   which is why you should own a `wpad` record in every internal DNS suffix.
   [WPAD and wpad.dat](https://findproxyforurl.net/wpad/) shows which client does what, and
   [Web proxy auto-detection](https://findproxyforurl.net/wpad/auto-detect/) explains the "Automatically detect settings"
   switch in Windows, macOS and the browsers.

## Serve the file at the web root, over HTTP

For the DNS way, the file must be reachable as exactly `http://wpad.<your domain>/wpad.dat`:

- a DNS record `wpad` in each internal DNS suffix, pointing at your web server,
- the file in the web root of that server, named `wpad.dat` in lower case,
- plain HTTP on port 80, because discovery does not use HTTPS,
- the content type `application/x-ns-proxy-autoconfig` and a short cache lifetime such as
  `Cache-Control: max-age=3600`.

Most web servers do not know the `.dat` extension. On Apache, set the type for this one file:

```apache
# Header needs mod_headers
<Files "wpad.dat">
    ForceType application/x-ns-proxy-autoconfig
    Header set Cache-Control "max-age=3600"
</Files>
```

On nginx, do the same in a location for the file:

```nginx
location = /wpad.dat {
    types { }
    default_type application/x-ns-proxy-autoconfig;
    add_header Cache-Control "max-age=3600";
}
```

On IIS, add a MIME type for `.dat` with the value `application/x-ns-proxy-autoconfig`; IIS does
not serve files whose extension has no MIME type.

Then test the delivery: paste the output of `curl -sI http://wpad.corp.example/wpad.dat` into the
checker under "Delivery" and choose "WPAD DNS discovery" or "DHCP option 252".

## Use discovery only where you cannot configure clients

Plain HTTP and unauthenticated DHCP mean that anyone who can answer first can hand out their own
file and with it route all web traffic. On managed devices, set the file's URL through group
policy or MDM and serve it over HTTPS instead; the [PAC file generator](https://findproxyforurl.net/generate/) lists where
that setting is on Windows, macOS and in the browsers. The [WPAD page](https://findproxyforurl.net/wpad/) covers the risks
and how to keep discovery safe, and [wpad.dat vs proxy.pac](https://findproxyforurl.net/articles/wpad-dat-vs-proxy-pac/)
compares the two ways of delivering the file.

## Test the file before clients find it

Clients that use discovery pick up a new wpad.dat without anyone noticing, so a mistake reaches
every one of them. Open the file in the [checker](https://findproxyforurl.net/check/) first, and try it on a test client
before you replace the file on the server. Ready-made files for common cases are on the
[PAC file examples](https://findproxyforurl.net/examples/) page; any of them works as a wpad.dat.


## Frequently asked questions

### What is a wpad.dat file?

A PAC file, a small JavaScript file with a FindProxyForURL function, saved under the name wpad.dat. That is the name clients ask for when they look for a proxy configuration on their own through WPAD.

### Where do I put the wpad.dat file?

In the web root of a server that answers as wpad.<your DNS suffix>, so that it is reachable as http://wpad.corp.example/wpad.dat. If you use DHCP option 252, the option contains the file's full URL instead.

### Which MIME type does wpad.dat need?

application/x-ns-proxy-autoconfig. Web servers usually do not know the .dat extension, so set the type for the file explicitly; IIS does not serve the file at all until a MIME type for .dat exists.

### Can wpad.dat be served over HTTPS?

Not for DNS discovery, which always asks for http://wpad.<suffix>/wpad.dat. A PAC file URL that you configure explicitly, for example by group policy, can and should use HTTPS.

### Is wpad.dat the same as proxy.pac?

Yes, in content. You can serve the same file under both names, as wpad.dat for discovery and as proxy.pac for clients that have the URL configured.