Windows 11 machines on my network keep generating DNS queries for WPAD roughly every few minutes. I have already tried disabling automatic proxy detection, setting WPAD-related registry policies, and changing service startup settings, but the queries continue. DNS blocking reduces the risk but does not stop the clients from making the requests. Is there a reliable way to prevent these WPAD lookups, or is the better approach to handle them at the DNS or proxy level?
3 Answers
The traffic volume from one WPAD lookup per device every several minutes is normally negligible, especially with cached or local DNS responses. If infrastructure is reporting millions of requests as a problem, measure the actual DNS latency and server load before changing client behavior. A fast authoritative response for the WPAD name is generally safer than repeated timeouts and also avoids leaving the name unclaimed, which can create a WPAD hijacking risk.
You can configure internal DNS to return a deliberate negative response for wpad and the relevant domain variants, such as wpad.local or wpad.example.internal. A hosts-file entry is another possibility, but it only handles the names placed there and may not stop applications from continuing to probe. Blocking the lookup prevents resolution, not necessarily the request itself, so seeing periodic queries in DNS logs can still be expected.
That is what I am seeing: even after adding a DNS deny rule, the clients continue asking about every ten minutes. The goal is to eliminate the queries, not just prevent WPAD from resolving.
WPAD discovery is not controlled by one single Windows component. WinHTTP, browsers, and other applications can perform their own probes, so disabling one setting or service may not eliminate every query. If you do not use automatic proxy configuration, the practical approach is usually to make WPAD resolve safely and quickly rather than forcing failed DNS timeouts. Register the WPAD name in internal DNS and serve a proxy configuration that returns DIRECT for every request: function FindProxyForURL(url, host) { return "DIRECT"; }
The infrastructure team is focused on removing roughly 4.5 million queries per day, even though the individual requests are small. They have rejected simply registering WPAD or returning a safe response, so I am specifically looking for a client-side way to stop the probes.