• Ensure that the web server has a MIME type application/x-ns-proxy-autoconfig configured for the .pac file extension. See the PAC Deployment page for more information.
• Disable the PAC file location in the browser proxy settings and enter the location of the PAC file in the browser URL bar, it should be accessible. If not, investigate the web server serving the file.
• Confirm that the JavaScript PAC file code is free of syntax errors/failures.

Browsers will cache a PAC file rather than retrieve it for each request; in some cases a browser restart is insufficient for obtaining an updated version of the file.In order to obtain the latest version it may be necessary to clear the browser cache, close all browser windows, and reopen the browser application.

Windows 2008, and a subsequent update for Windows 2003 DNS, implemented a DNS block list (globalqueryblocklist) for commonly abused queries which may be blocking resolution of the WPAD host.

In order to allow Windows 2008 DNS to resolve the host WPAD, please see the Microsoft article on this issue.

A command line option isn’t available for Windows 2003, thus changes need to be made to the Windows Registry.

1. Open the Windows Registry on each DNS server (e.g. Start > Run > Regedit).
2. Locate the registry key location in the table below.
3. Right-click > Modify on the GlobalQueryBlockList key.
4. Remove the wpad entry and click OK.
5. You will need to restart the Windows DNS Server service in order for this change to take effect.

Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
Name	GlobalQueryBlockList
Type	REG_MULTI_SZ
Data	wpad isatap

Firefox solely supports DNS WPAD, DHCP WPAD is not supported. Please see the WPAD Explained and Browser Support pages for more information.

A PAC file may leverage several functions which rely on the local DNS server(s) in order to resolve a requested host. These functions are isInNet(), isResolvable(), and dnsResolve().

Should a DNS server be slow to respond, the initialization of these functions for a new (non-cached) host will result in a delay until the result is provided by the DNS server(s). This will only occur the first time the host is requested, or if the local caching period for the host DNS information has expired.

Such an issue can be isolated by utilizing a DNS application such as DIG which can report how long it took the DNS server to respond. While each environment is unique, response times exceeding 500ms are likely to be noticeable to an end-user. Many websites now use content delivery networks which may provide content from several different hosts, thus the delay could be significant for larger websites; each host is requested in serial rather than parallel (each DNS request must complete before the next begins).

When using the IP address location of the PAC file, the browser will attempt to connect to this IP address and will wait until the connection attempt times out. The timeout may not occur for several seconds or more, and may result in some browsers hanging until this occurs. This delay will occur when the browser is first loaded and a website accessed.

Given this timeout behavior, if the user machine is to be taken off-network it’s recommended that the browser be configured with the DNS hostname for accessing the PAC file.

When using the DNS hostname for the PAC file, the browser will try to resolve the internal DNS hostname against an external DNS server. This will result in the server informing the web browser that no such DNS record exists. This process will take tenths of a second and is unnoticed by the end-user. The browser, being unable to access the PAC file, will fail open (direct to the Internet).