# Web proxy auto-detection: what "Automatically detect settings" does

Source: https://findproxyforurl.net/wpad/auto-detect/ · updated 2026-10-11

Changed 2026-10-11: The page now links the new article on PAC file troubleshooting, and the wpad.dat test steps use the live trace.

The check box "Automatically detect settings" switches on WPAD, the Web Proxy Auto-Discovery Protocol. The computer then asks the network for a PAC file instead of using one you configured. This page shows where the switch is in each system, what it costs, and how to turn it off safely.

How WPAD works, where it came from and why it is risky is explained on the [WPAD page](https://findproxyforurl.net/wpad/). In
short: with auto-detection on, the client first asks DHCP for option 252, which can carry a PAC URL.
If that gives nothing, it looks up a host called `wpad` in DNS and fetches
`http://wpad.<domain>/wpad.dat`. The first answer decides where all web traffic goes.

The alternative is an explicit PAC URL, set by group policy or MDM (mobile device management). For
managed devices that is the better choice, for the reasons below.

## Auto-detection costs time before the first request

A client with auto-detection on cannot send its first request until it knows whether a PAC file
exists. On a network without WPAD, it has to wait until DHCP and DNS give up.

- Microsoft's WinHTTP documentation says that auto-detection "can be slow, possibly as long as several
  seconds", and that WinHTTP tries DHCP first and DNS second.
- Chromium (the code behind Chrome and Edge) first checks quickly whether the name `wpad` resolves
  at all and gives that check one second. After every change of IP address it waits two seconds and
  then detects again. When detection fails, it tries again after 8 seconds, 32 seconds, 2 minutes and
  then every 4 hours.
- Firefox waits up to five seconds for the DHCP answer on Windows (the preference
  `network.proxy.dhcp_wpad_timeout_sec`).

On laptops that change networks often, these waits come back every time. An explicit PAC URL has no
such step: the client fetches the file it was told to fetch.

## Auto-detection lets the network choose your proxy

Whoever answers first supplies the PAC file, and the PAC file can send all traffic through any
proxy. Three things make that answer easy to fake:

- **DNS:** a client may ask for `wpad` names outside your own domain, and public `wpad` names have
  been registered and abused (US-CERT alert TA16-144A). The rule
  [PAC-D007: PAC distributed via WPAD DNS discovery](https://findproxyforurl.net/rules/wpad-dns-discovery/) explains the attack
  and the defence.
- **DHCP:** any device on the same network segment can answer DHCP and hand out its own PAC URL
  ([PAC-D008](https://findproxyforurl.net/rules/dhcp-option-252/)).
- **Plain HTTP:** the discovered file is fetched without encryption, so anyone on the path can change
  it ([PAC-D001](https://findproxyforurl.net/rules/pac-over-plain-http/)).

On a hotel or café network, a laptop with auto-detection on accepts the proxy configuration of
whoever runs that network.

## Where the switch is in each system

### Windows

- **Settings:** *Network & internet > Proxy*, section *Automatic proxy setup*, switch
  **Automatically detect settings**. The same page has *Use setup script* for an explicit PAC URL.
- **Internet Options** (`inetcpl.cpl`): tab *Connections*, button *LAN settings*, check box
  **Automatically detect settings**.
- **WinHTTP**, the HTTP library used by Windows services and many agents, runs discovery through the
  **WinHTTP Web Proxy Auto-Discovery Service** (`WinHttpAutoProxySvc`). From Windows 10 version 1809
  and Windows Server 2019, the DWORD value `DisableWpad` = `1` under
  `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp` stops WPAD for all
  WinHTTP calls. Microsoft says to switch auto-detection off in Settings as well, because browsers and
  other programs read that setting.
- **Do not disable the service itself.** Microsoft's service guidance for Windows Server says "Do not
  disable" `WinHttpAutoProxySvc`, because anything that uses the network stack can depend on it.
- **Group Policy:** the user policy *Windows Components > Internet Explorer > Disable changing
  Automatic Configuration settings* greys out the automatic configuration settings in the Internet
  Options dialog, so users cannot change them there. It locks the setting; it does not switch it off.

### macOS

*System Settings > Network*, select the network service, *Details > Proxies*, switch
**Auto proxy discovery**. The switch *Automatic proxy configuration* next to it is the explicit PAC
URL. Apple's deployment guide describes the same discovery for proxies set to "Automatic" by MDM
without a URL: the device asks for `wpad.dat` through DHCP (option 252) or DNS (an A record named
`wpad`). With MDM, give the proxy settings an explicit PAC URL instead of relying on discovery.

### Chrome and Edge

Chrome and Edge use the operating system's proxy settings by default, including its auto-detect
switch, and then run the discovery with their own network code. On Windows that includes DHCP; on
other systems only the DNS lookup for `wpad`.

- **Policy:** `ProxySettings` (or the older single policy `ProxyMode`) with the mode `pac_script` and
  `ProxyPacUrl` sets an explicit PAC URL and ignores auto-detection. `auto_detect` switches it on,
  `system` follows the operating system, `direct` uses no proxy. In Edge the Group Policy is
  *Administrative Templates > Microsoft Edge > Proxy server > Proxy settings*.
- **Command line, for testing:** `--proxy-auto-detect` forces auto-detection in one browser profile,
  `--no-proxy-server` switches every proxy off, and `--proxy-pac-url=<URL>` uses one PAC file.
  The article on [debugging a PAC file in Chrome, Edge and Firefox](https://findproxyforurl.net/articles/debug-pac-chrome-edge-firefox/)
  shows how to see which proxy was chosen.

### Firefox

*Settings > General > Network Settings > Settings…* offers **Auto-detect proxy settings for this
network**, which is Firefox's own WPAD. It looks up `http://wpad/wpad.dat`, and on Windows it asks DHCP
first (since Firefox 63). Firefox's default, **Use system proxy settings**, takes a configured PAC URL
from the system but, in the current source, does not follow the system's auto-detect switch unless
the preference `network.proxy.system_wpad` is `true`.

- **Policy:** the enterprise policy `Proxy` with `"Mode": "autoConfig"`, an `AutoConfigURL` and
  `"Locked": true` sets the explicit PAC URL and stops users from changing it. `"Mode": "autoDetect"`
  is the auto-detect option.

## Turning auto-detection off safely

1. Publish the PAC file at a fixed `https://` URL, for example `https://pac.corp.example/proxy.pac`,
   served as described on the page of [PAC and wpad.dat best practices](https://findproxyforurl.net/best-practices/).
2. Distribute that URL: Windows *Use setup script* or the browser policies above, macOS *Automatic
   proxy configuration* or an MDM profile.
3. Then switch auto-detection off everywhere: the Windows switch and `DisableWpad`, macOS
   *Auto proxy discovery*, and the browser policies.
4. Keep an authoritative `wpad` record, or a deliberate NXDOMAIN answer, in every internal DNS suffix
   for the devices you do not manage, and block `wpad.*` lookups to the internet at your resolvers.
5. Check the result from a client: test the file in the [PAC file tester](https://findproxyforurl.net/check/) and watch which
   `wpad` names still appear in your DNS logs.

If a client still does not find or load the file, the article
[PAC file troubleshooting](https://findproxyforurl.net/articles/pac-file-troubleshooting/) goes through the symptoms, including
the Windows WinHTTP errors 12167 and 12180.

## Sources

- [Microsoft: Use a proxy server in Windows](https://support.microsoft.com/en-us/windows/experience/connectivity-networking/use-a-proxy-server-in-windows)
- [Microsoft: How to disable HTTP proxy features (DisableWpad)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/disable-http-proxy-auth-features)
- [Microsoft: AutoProxy issues in WinHTTP (performance)](https://learn.microsoft.com/en-us/windows/win32/winhttp/autoproxy-issues-in-winhttp)
- [Microsoft: Security guidelines for system services in Windows Server 2016 (WinHttpAutoProxySvc)](https://learn.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server)
- [Microsoft Edge policy: ProxySettings](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/proxysettings)
- [Apple: Enter proxy server settings on Mac](https://support.apple.com/guide/mac-help/mchlp25912/mac)
  and [Apple Platform Deployment: VPN proxy settings](https://support.apple.com/guide/deployment/depb78836926/web)
- [Chromium source: pac_file_decider.cc](https://chromium.googlesource.com/chromium/src/+/main/net/proxy_resolution/pac_file_decider.cc)
  and [configured_proxy_resolution_service.cc](https://chromium.googlesource.com/chromium/src/+/main/net/proxy_resolution/configured_proxy_resolution_service.cc)
- [Firefox source: nsPACMan.cpp](https://searchfox.org/mozilla-central/source/netwerk/base/nsPACMan.cpp)
  and [Firefox enterprise policy: Proxy](https://mozilla.github.io/policy-templates/#proxy)
- [US-CERT TA16-144A: WPAD name collision vulnerability](https://www.us-cert.gov/ncas/alerts/TA16-144A)


## Frequently asked questions

### What does "Automatically detect settings" do?

It makes the computer look for a proxy configuration file (a PAC file) on the network with WPAD, first through DHCP option 252 and then through a DNS lookup for a host called wpad. If it finds one, the browser uses that file to decide which proxy to use for every request.

### Should I turn off "Automatically detect settings"?

On managed devices that get their PAC URL from group policy or MDM, yes, because detection adds delay and lets anyone who can answer DHCP or the wpad name on the network supply the proxy configuration. Keep it only where you deliberately use WPAD and own every wpad name in your DNS suffixes.

### Why is the first page slow when auto-detect is on?

Before the first request the client has to ask DHCP and DNS for a PAC URL and wait for an answer or a timeout. Microsoft documents that this can take several seconds in WinHTTP, and Chromium runs the detection again after every network change.

### How do I disable WPAD by Group Policy?

Configure the proxy explicitly for each client. For Chrome and Edge set the ProxySettings policy (or ProxyMode) to pac_script with your PAC URL; for Firefox set the Proxy policy to autoConfig with an AutoConfigURL and lock it. For Windows itself switch off "Automatically detect settings" and, from Windows 10 version 1809, set the DisableWpad registry value for WinHTTP. Do not disable the WinHTTP Web Proxy Auto-Discovery Service.

### Does Firefox use the Windows "Automatically detect settings" switch?

Not by default. In the current Firefox source, "Use system proxy settings" takes a configured PAC URL from the system but ignores the system's auto-detect switch unless the preference network.proxy.system_wpad is true. Firefox has its own option "Auto-detect proxy settings for this network".