Windows 11 computers on my network keep generating DNS queries for WPAD, apparently about every ten minutes. I have already tried disabling automatic proxy detection, setting WPAD-related registry and policy options, and changing service startup settings, but the queries continue. Is there a reliable way to prevent these requests, or at least handle them without adding unnecessary DNS traffic?
4 Answers
The volume is probably not harmful by itself. Even millions of small cached DNS queries generally should not create noticeable load on a properly configured DNS server, so it may be worth measuring the actual latency and server utilization before treating the requests as a problem. If the infrastructure team still wants them gone, client policies can be enforced, but they may not cover probes made independently by other applications.
If you do not use WPAD, configure your internal DNS to answer authoritatively for names such as wpad, wpad.local, and the relevant domain-specific WPAD names. Returning a quick negative response or a controlled empty result can prevent repeated retries and stop the name from being hijacked. A hosts-file entry is another possible client-side workaround, but it will not necessarily stop every application from attempting a lookup.
There may not be one system-wide switch that stops every WPAD lookup. Windows components and individual applications can perform their own discovery probes, even when automatic proxy detection is disabled. A practical approach is to host a valid WPAD record and serve a small proxy configuration file that returns DIRECT for every request. That makes the lookup complete immediately instead of timing out, and registering the name also prevents someone else from claiming it later.
Registry settings, browser policies, and disabling the WinHTTP proxy discovery service can help in some cases, but they are not universal. The service may also be required by other Windows networking features, and you have already found that disabling it is not viable. In practice, controlled DNS responses or a direct-return WPAD configuration are usually more dependable than trying to disable every component that can perform discovery.
I tried denying the name in my DNS server, but the clients still appear to query it periodically. The goal is to eliminate the requests if possible, not merely make them return no data.