Skip to main content

WPAD does not resolve in DNS

At work, we're doing a POC (proof of concept) with a web-proxy, specifically Ironport Websecurity Appliance. Like most all proxies, you have to get the traffic from the client to the proxy. It supports transparent traffic redirection, but we're looking at using WPAD instead.

However, when I created the WPAD DNS entry, it didn't resolve.

C:\>ping wpad
Ping request could not find host wpad. Please check the name and try again.

C:\>nslookup wpad <DNSServer1>
Server: <DNSServer1>
Address: <IPofDNSServer1>
*** <DNSServer1> can't find wpad: Non-existent domain

This of course, is a big problem. It took a little investigating, but I found the cause.
Windows Server 2008 introduced a new feature, called "Global Query Block list", which prevents some arbitrary machine from registering the DNS name of WPAD. This is a good security feature, as it prevents someone from just joining your network, and setting himself up as a proxy. 

However, my DNS server is Windows 2003? 

It doesn't have the "Global Query Block List". 

Well, when the documentation was written, it didn't, but a DNS service patch Microsoft published last year DID!
As far as I can tell, included the "Global Query Block List", it's not supposed to be enabled by default but mine was, and I did not intentionally turn it on, But here's the best news, not all the pieces of the feature made it down to 2003. The TechNet article: shows how to manipulate the "Global Query Block List", and sure enough, the command of:
dnscmd /info /enableglobalqueryblocklist
Query result:
Dword: 1 (0000000000000001)
Command completed successfully.

Shows the block list is enabled, but the command:
dnscmd /info /globalqueryblocklist Info query failed status = 9553 (0x00002551) Command failed: DNS_ERROR_INVALID_PROPERTY 9553 (00002551)

Which is supposed to show you what's in the block list fails.
So there are two options here:
1. Turn off the "Global Query Block List"
2. Remove WPAD from the "Global Query Block List"
Turning off "Global Query Block List" is easy, just run the command:

dnscmd /config /enableglobalqueryblocklist 0 

That's it. It's off. No service restart required. But what if you turned it off and want to turn it back on? You can't run the opposite command of:
dnscmd /config /enableglobalqueryblocklist 0 
Why not? Cause Microsoft goofed in they're documentation. It's actually the same command as to turn it off!  The correct command is:
dnscmd /config /enableglobalqueryblocklist 1

To remove WPAD, but leave the Blocklist enabled, is a little more difficult

The "Global Query Block List " is stored here:


Mine had the entries of WPAD and ISATAP. Remove the WPAD entry and restart the DNS service for it to reload the Blocklist. Note, there is a trailing newline character after ISATAP, it's best to leave it there. 

Note, there is a command line that is supposed to edit this blocklist, but again it's broken in the 2003 implementation, hopefully a later patch, or Service pack will fix these features. Make sure to makes changes to all your DNS services. 

This is a per machine setting, not a zone setting, so if your using Active Directory Integrated zones, it won't replicate this change.


  1. Nice helped me thanks.

  2. Great article explaining what is happening and how to correct the issue. Thank you.

  3. This saved my arse this morning thanks, I was at a complete loss why my new DNS server wasn't resolving wpad when I was staring at the record right in front of me!

  4. Nice article, helped me get it right. I was a loss why my Win 2012 DNS server can resolve anything but wpad.

  5. Great help Thank You

  6. You saved my ... THANKS!

  7. still applicable in WS2016, tyvm

  8. 9 years after writing this post and it is STILL relevant! Thanks for this.

  9. We are using DSC to manage this setting on our DNS (GC) servers. Just makes life easier. Thank you for the article. It helped a lot.


Post a Comment

Popular posts from this blog

Embed a Slideshow from Picasa Web / Google Plus

One of the great features of Picasa Web was that you could embed a Flash slideshow of your albums. Google would even give you the code to do it.  There was a button that said Embed and it would give you the code. Just cut and paste and you were done. With the migration to Google Plus Photos, this disappeared. Here's a work around. Use the following link to get back to the original PicasaWeb site. lh/myphotos?noredirect=1 Hopefully the embed button makes a re-appearance, or Google leaves the old page up forever. *******UPDATE******* One of the commenters below posted this website. It seems to work pretty good!