WPAD
Web Proxy Auto-Discovery, the mechanism behind the automatically detect settings checkbox, which lets a network hand your machine its proxy configuration.
There is a checkbox in every operating system's proxy settings that says something like automatically detect settings, and almost nobody knows what it does. It switches on WPAD, Web Proxy Auto-Discovery: a protocol by which your machine asks the network it joined whether there is a proxy it should be using, and configures whatever it is told.
Discovery runs two ways, tried in order. The network's DHCP server, the same one that handed your machine its address, can answer with a configuration URL directly, via option 252. Failing that, the machine falls back to DNS guesswork: it prepends the name wpad to its own domain and tries to resolve it, walking up the domain hierarchy until something answers. Whatever host it finds, it fetches a file conventionally called wpad.dat, which is a PAC file, and from then on routes browser traffic according to the rules inside.
The design intent is entirely reasonable: an organisation with hundreds of machines wants proxy configuration to be automatic on join, updated centrally, and gone when the laptop leaves. Corporate networks depend on it, and it is why a work machine often uses a proxy its user never configured and cannot see. Paired with a transparent proxy at the gateway, it is how managed networks route traffic with zero per-device setup.
The security record is the caution. A machine that asks an untrusted network who should carry my web traffic is inviting an answer from anyone positioned to give one: a rogue device answering the DHCP query, or a registered hostname that happens to match the DNS walk, receives a request to route the victim's browsing through itself. Variants of this have produced real incidents for two decades, including name-collision leaks when corporate domain suffixes met new public top-level domains. The protocol authenticates nothing; it trusts the network it is on.
The practical rule follows the trust: on a managed corporate machine, leave it as IT set it, because things will break otherwise. On a personal machine that lives on home and public networks, auto-detection is a door with no lock and nothing behind it you need, and turning it off costs you nothing. For proxy work specifically, WPAD is also a way to be proxied without noticing, which is worth ruling out when traffic behaves strangely on someone else's network.
Frequently asked questions
Should automatically detect settings be on or off?
On a personal machine, off: home networks offer nothing through it, and on untrusted networks it invites whoever controls DHCP or a lucky hostname to volunteer as your proxy. On a managed work machine, leave it alone, because the organisation's routing may depend on it and IT chose the setting deliberately.
How does WPAD actually find the proxy?
Two attempts in order: it asks the local DHCP server for a configuration URL through option 252, and if that yields nothing it resolves hostnames, prefixing wpad to its own DNS domain and walking up the hierarchy until one answers. The file it fetches from the discovered host is a PAC file, and its rules then govern how browser traffic is routed.
Is WPAD dangerous?
The mechanism authenticates nobody, so its risk is the network you are on. Anywhere untrusted, a machine broadcasting who should proxy my traffic can be answered by an attacker, and history includes exactly such incidents, including collisions between corporate domain suffixes and newly public top-level domains. On a well-run internal network the same behaviour is what makes central configuration work.
Why does my work laptop use a proxy I never configured?
Because the network configured it: discovery fetched a PAC file when the machine joined, and traffic has followed its rules since. That is the intended enterprise behaviour, giving IT central control and visibility. It is also worth remembering when debugging connectivity on such a machine, since requests may be routed somewhere no local setting admits to.
Back to the full glossary.