Web proxy auto-detection: what "Automatically detect settings" does

The check box "Automatically detect settings" switches on WPAD, the Web Proxy Auto-Discovery Protocol. The computer then asks the network for a PAC file instead of using one you configured. This page shows where the switch is in each system, what it costs, and how to turn it off safely.

How WPAD works, where it came from and why it is risky is explained on the WPAD page. In short: with auto-detection on, the client first asks DHCP for option 252, which can carry a PAC URL. If that gives nothing, it looks up a host called wpad in DNS and fetches http://wpad.<domain>/wpad.dat. The first answer decides where all web traffic goes.

The alternative is an explicit PAC URL, set by group policy or MDM (mobile device management). For managed devices that is the better choice, for the reasons below.

Auto-detection costs time before the first request

A client with auto-detection on cannot send its first request until it knows whether a PAC file exists. On a network without WPAD, it has to wait until DHCP and DNS give up.

• Microsoft’s WinHTTP documentation says that auto-detection “can be slow, possibly as long as several seconds”, and that WinHTTP tries DHCP first and DNS second.
• Chromium (the code behind Chrome and Edge) first checks quickly whether the name wpad resolves at all and gives that check one second. After every change of IP address it waits two seconds and then detects again. When detection fails, it tries again after 8 seconds, 32 seconds, 2 minutes and then every 4 hours.
• Firefox waits up to five seconds for the DHCP answer on Windows (the preference network.proxy.dhcp_wpad_timeout_sec).

On laptops that change networks often, these waits come back every time. An explicit PAC URL has no such step: the client fetches the file it was told to fetch.

Auto-detection lets the network choose your proxy

Whoever answers first supplies the PAC file, and the PAC file can send all traffic through any proxy. Three things make that answer easy to fake:

• DNS: a client may ask for wpad names outside your own domain, and public wpad names have been registered and abused (US-CERT alert TA16-144A). The rule PAC-D007: PAC distributed via WPAD DNS discovery explains the attack and the defence.
• DHCP: any device on the same network segment can answer DHCP and hand out its own PAC URL (PAC-D008).
• Plain HTTP: the discovered file is fetched without encryption, so anyone on the path can change it (PAC-D001).

On a hotel or café network, a laptop with auto-detection on accepts the proxy configuration of whoever runs that network.

Where the switch is in each system

Windows

• Settings: Network & internet > Proxy, section Automatic proxy setup, switch Automatically detect settings. The same page has Use setup script for an explicit PAC URL.
• Internet Options (inetcpl.cpl): tab Connections, button LAN settings, check box Automatically detect settings.
• WinHTTP, the HTTP library used by Windows services and many agents, runs discovery through the WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc). From Windows 10 version 1809 and Windows Server 2019, the DWORD value DisableWpad = 1 under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp stops WPAD for all WinHTTP calls. Microsoft says to switch auto-detection off in Settings as well, because browsers and other programs read that setting.
• Do not disable the service itself. Microsoft’s service guidance for Windows Server says “Do not disable” WinHttpAutoProxySvc, because anything that uses the network stack can depend on it.
• Group Policy: the user policy Windows Components > Internet Explorer > Disable changing Automatic Configuration settings greys out the automatic configuration settings in the Internet Options dialog, so users cannot change them there. It locks the setting; it does not switch it off.

macOS

System Settings > Network, select the network service, Details > Proxies, switch Auto proxy discovery. The switch Automatic proxy configuration next to it is the explicit PAC URL. Apple’s deployment guide describes the same discovery for proxies set to “Automatic” by MDM without a URL: the device asks for wpad.dat through DHCP (option 252) or DNS (an A record named wpad). With MDM, give the proxy settings an explicit PAC URL instead of relying on discovery.

Chrome and Edge

Chrome and Edge use the operating system’s proxy settings by default, including its auto-detect switch, and then run the discovery with their own network code. On Windows that includes DHCP; on other systems only the DNS lookup for wpad.

• Policy: ProxySettings (or the older single policy ProxyMode) with the mode pac_script and ProxyPacUrl sets an explicit PAC URL and ignores auto-detection. auto_detect switches it on, system follows the operating system, direct uses no proxy. In Edge the Group Policy is Administrative Templates > Microsoft Edge > Proxy server > Proxy settings.
• Command line, for testing: --proxy-auto-detect forces auto-detection in one browser profile, --no-proxy-server switches every proxy off, and --proxy-pac-url=<URL> uses one PAC file. The article on debugging a PAC file in Chrome, Edge and Firefox shows how to see which proxy was chosen.

Firefox

Settings > General > Network Settings > Settings… offers Auto-detect proxy settings for this network, which is Firefox’s own WPAD. It looks up http://wpad/wpad.dat, and on Windows it asks DHCP first (since Firefox 63). Firefox’s default, Use system proxy settings, takes a configured PAC URL from the system but, in the current source, does not follow the system’s auto-detect switch unless the preference network.proxy.system_wpad is true.

• Policy: the enterprise policy Proxy with "Mode": "autoConfig", an AutoConfigURL and "Locked": true sets the explicit PAC URL and stops users from changing it. "Mode": "autoDetect" is the auto-detect option.

Turning auto-detection off safely

1. Publish the PAC file at a fixed https:// URL, for example https://pac.corp.example/proxy.pac, served as described on the page of PAC and wpad.dat best practices.
2. Distribute that URL: Windows Use setup script or the browser policies above, macOS Automatic proxy configuration or an MDM profile.
3. Then switch auto-detection off everywhere: the Windows switch and DisableWpad, macOS Auto proxy discovery, and the browser policies.
4. Keep an authoritative wpad record, or a deliberate NXDOMAIN answer, in every internal DNS suffix for the devices you do not manage, and block wpad.* lookups to the internet at your resolvers.
5. Check the result from a client: test the file in the PAC file tester and watch which wpad names still appear in your DNS logs.

If a client still does not find or load the file, the article PAC file troubleshooting goes through the symptoms, including the Windows WinHTTP errors 12167 and 12180.

Sources

• Microsoft: Use a proxy server in Windows
• Microsoft: How to disable HTTP proxy features (DisableWpad)
• Microsoft: AutoProxy issues in WinHTTP (performance)
• Microsoft: Security guidelines for system services in Windows Server 2016 (WinHttpAutoProxySvc)
• Microsoft Edge policy: ProxySettings
• Apple: Enter proxy server settings on Mac and Apple Platform Deployment: VPN proxy settings
• Chromium source: pac_file_decider.cc and configured_proxy_resolution_service.cc
• Firefox source: nsPACMan.cpp and Firefox enterprise policy: Proxy
• US-CERT TA16-144A: WPAD name collision vulnerability

Frequently asked questions

What does "Automatically detect settings" do?

It makes the computer look for a proxy configuration file (a PAC file) on the network with WPAD, first through DHCP option 252 and then through a DNS lookup for a host called wpad. If it finds one, the browser uses that file to decide which proxy to use for every request.

Should I turn off "Automatically detect settings"?

On managed devices that get their PAC URL from group policy or MDM, yes, because detection adds delay and lets anyone who can answer DHCP or the wpad name on the network supply the proxy configuration. Keep it only where you deliberately use WPAD and own every wpad name in your DNS suffixes.

Why is the first page slow when auto-detect is on?

Before the first request the client has to ask DHCP and DNS for a PAC URL and wait for an answer or a timeout. Microsoft documents that this can take several seconds in WinHTTP, and Chromium runs the detection again after every network change.

How do I disable WPAD by Group Policy?

Configure the proxy explicitly for each client. For Chrome and Edge set the ProxySettings policy (or ProxyMode) to pac_script with your PAC URL; for Firefox set the Proxy policy to autoConfig with an AutoConfigURL and lock it. For Windows itself switch off "Automatically detect settings" and, from Windows 10 version 1809, set the DisableWpad registry value for WinHTTP. Do not disable the WinHTTP Web Proxy Auto-Discovery Service.

Does Firefox use the Windows "Automatically detect settings" switch?

Not by default. In the current Firefox source, "Use system proxy settings" takes a configured PAC URL from the system but ignores the system's auto-detect switch unless the preference network.proxy.system_wpad is true. Firefox has its own option "Auto-detect proxy settings for this network".