Bottom line: Review the existing host and TXT records before selecting automatic WPAD publication. Preserve the domain’s other DNS purposes and choose an explicitly reviewed publication branch.
\nThe OPNsense WPAD/PAC guide says WPAD discovers the PAC file for a domain. Its automatic Unbound branch overwrites the domain’s WPAD host and TXT records and warns that this can break other TXT uses such as SPF. The same branch defines hosts for DHCP-configured domains as aliases of the firewall host and publishes the PAC URL through TXT records. The guide also documents a manual DNS host override for wpad, using an A or AAAA record and the OPNsense web-interface address.
This article addresses DNS ownership and replacement in the guide’s publication branches. It does not establish browser discovery support or approve an HTTP management exposure, certificate exception or organization-wide proxy rollout.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends exporting the current relevant DNS records before selecting the automatic option. Put the WPAD host, domain TXT population, intended PAC location and responsible DNS owner in one review. Ask the owner to identify existing uses, including mail-policy dependencies, rather than assuming the domain records are dedicated to proxy discovery.
\nCompare the guide’s automatic publication scope with the actual DHCP domain list. Mark every proposed replacement and resolve ownership conflicts before enabling the option. Where automatic replacement is unsuitable, assess the documented manual branch with the DNS owner instead of trying to repair unrelated records after the change.
\nUse a disposable test domain or another expressly approved isolated scope for the first review. Prepare a before-and-expected record set that retains the domain’s required non-WPAD purposes. Keep browser behavior, PAC hosting and management-interface exposure as separate assessments; do not solve an ownership conflict by casually weakening those controls.
\nAssign responsibility for future PAC-location and domain changes. Preserve a recovery copy of the original records and specify who can restore them. Require a second reviewer to reconcile the selected publication branch with the proposed record set before authorizing a production DNS modification.
\nProposed verification: compare the relevant DNS answers and authoritative configuration before and after the isolated change. Record which WPAD host and TXT entries actually changed, including any unexpected deletion or replacement. Check the owner’s other required TXT uses against the approved record set rather than accepting PAC discovery alone.
\nHave another operator follow the written branch selection and locate the resulting PAC reference. Record discovery observations separately from a browser or proxy acceptance test. Restore the isolated scope through the approved cleanup procedure and retain the record comparison, ownership decision and unresolved dependencies with the change request.
\nSource review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change.
\n", "content_text": "Bottom line: Review the existing host and TXT records before selecting automatic WPAD publication. Preserve the domain’s other DNS purposes and choose an explicitly reviewed publication branch.\nSource fact: what the authority says\nThe OPNsense WPAD/PAC guide says WPAD discovers the PAC file for a domain. Its automatic Unbound branch overwrites the domain’s WPAD host and TXT records and warns that this can break other TXT uses such as SPF. The same branch defines hosts for DHCP-configured domains as aliases of the firewall host and publishes the PAC URL through TXT records. The guide also documents a manual DNS host override for wpad, using an A or AAAA record and the OPNsense web-interface address.\nWhat the source does not establish\nThis article addresses DNS ownership and replacement in the guide’s publication branches. It does not establish browser discovery support or approve an HTTP management exposure, certificate exception or organization-wide proxy rollout.\nApplicability questions\n\nWho owns the existing WPAD host and domain TXT records?\nWhich DHCP-configured domains are included in the proposed automatic branch?\nWhat other documented use depends on those TXT records?\nWill the plan use automatic publication or an explicitly maintained manual record?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends exporting the current relevant DNS records before selecting the automatic option. Put the WPAD host, domain TXT population, intended PAC location and responsible DNS owner in one review. Ask the owner to identify existing uses, including mail-policy dependencies, rather than assuming the domain records are dedicated to proxy discovery.\nCompare the guide’s automatic publication scope with the actual DHCP domain list. Mark every proposed replacement and resolve ownership conflicts before enabling the option. Where automatic replacement is unsuitable, assess the documented manual branch with the DNS owner instead of trying to repair unrelated records after the change.\nUse a disposable test domain or another expressly approved isolated scope for the first review. Prepare a before-and-expected record set that retains the domain’s required non-WPAD purposes. Keep browser behavior, PAC hosting and management-interface exposure as separate assessments; do not solve an ownership conflict by casually weakening those controls.\nAssign responsibility for future PAC-location and domain changes. Preserve a recovery copy of the original records and specify who can restore them. Require a second reviewer to reconcile the selected publication branch with the proposed record set before authorizing a production DNS modification.\nVerification and evidence\nProposed verification: compare the relevant DNS answers and authoritative configuration before and after the isolated change. Record which WPAD host and TXT entries actually changed, including any unexpected deletion or replacement. Check the owner’s other required TXT uses against the approved record set rather than accepting PAC discovery alone.\nHave another operator follow the written branch selection and locate the resulting PAC reference. Record discovery observations separately from a browser or proxy acceptance test. Restore the isolated scope through the approved cleanup procedure and retain the record comparison, ownership decision and unresolved dependencies with the change request.\nOfficial references\n\nOPNsense — Setup WPAD / PAC — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "content_markdown": "Bottom line: Review the existing host and TXT records before selecting automatic WPAD publication. Preserve the domain’s other DNS purposes and choose an explicitly reviewed publication branch.\n\n## Source fact: what the authority says\n\nThe [OPNsense WPAD/PAC guide](https://docs.opnsense.org/manual/how-tos/pac.html) says WPAD discovers the PAC file for a domain. Its automatic Unbound branch overwrites the domain’s WPAD host and TXT records and warns that this can break other TXT uses such as SPF. The same branch defines hosts for DHCP-configured domains as aliases of the firewall host and publishes the PAC URL through TXT records. The guide also documents a manual DNS host override for wpad, using an A or AAAA record and the OPNsense web-interface address.\n\n## What the source does not establish\n\nThis article addresses DNS ownership and replacement in the guide’s publication branches. It does not establish browser discovery support or approve an HTTP management exposure, certificate exception or organization-wide proxy rollout.\n\n## Applicability questions\n\n- Who owns the existing WPAD host and domain TXT records?\n\n- Which DHCP-configured domains are included in the proposed automatic branch?\n\n- What other documented use depends on those TXT records?\n\n- Will the plan use automatic publication or an explicitly maintained manual record?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends exporting the current relevant DNS records before selecting the automatic option. Put the WPAD host, domain TXT population, intended PAC location and responsible DNS owner in one review. Ask the owner to identify existing uses, including mail-policy dependencies, rather than assuming the domain records are dedicated to proxy discovery.\n\nCompare the guide’s automatic publication scope with the actual DHCP domain list. Mark every proposed replacement and resolve ownership conflicts before enabling the option. Where automatic replacement is unsuitable, assess the documented manual branch with the DNS owner instead of trying to repair unrelated records after the change.\n\nUse a disposable test domain or another expressly approved isolated scope for the first review. Prepare a before-and-expected record set that retains the domain’s required non-WPAD purposes. Keep browser behavior, PAC hosting and management-interface exposure as separate assessments; do not solve an ownership conflict by casually weakening those controls.\n\nAssign responsibility for future PAC-location and domain changes. Preserve a recovery copy of the original records and specify who can restore them. Require a second reviewer to reconcile the selected publication branch with the proposed record set before authorizing a production DNS modification.\n\n## Verification and evidence\n\nProposed verification: compare the relevant DNS answers and authoritative configuration before and after the isolated change. Record which WPAD host and TXT entries actually changed, including any unexpected deletion or replacement. Check the owner’s other required TXT uses against the approved record set rather than accepting PAC discovery alone.\n\nHave another operator follow the written branch selection and locate the resulting PAC reference. Record discovery observations separately from a browser or proxy acceptance test. Restore the isolated scope through the approved cleanup procedure and retain the record comparison, ownership decision and unresolved dependencies with the change request.\n\n## Official references\n\n- [OPNsense — Setup WPAD / PAC](https://docs.opnsense.org/manual/how-tos/pac.html) — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/", "url": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Review WPAD DNS replacement before enabling automatic publication", "item": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/#article", "identifier": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/", "url": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/", "headline": "Review WPAD DNS replacement before enabling automatic publication", "description": "Check existing WPAD host and domain TXT records before choosing the guide’s automatic Unbound publication branch.", "abstract": "Check existing WPAD host and domain TXT records before choosing the guide’s automatic Unbound publication branch.", "articleBody": "Bottom line: Review the existing host and TXT records before selecting automatic WPAD publication. Preserve the domain’s other DNS purposes and choose an explicitly reviewed publication branch.\nSource fact: what the authority says\nThe OPNsense WPAD/PAC guide says WPAD discovers the PAC file for a domain. Its automatic Unbound branch overwrites the domain’s WPAD host and TXT records and warns that this can break other TXT uses such as SPF. The same branch defines hosts for DHCP-configured domains as aliases of the firewall host and publishes the PAC URL through TXT records. The guide also documents a manual DNS host override for wpad, using an A or AAAA record and the OPNsense web-interface address.\nWhat the source does not establish\nThis article addresses DNS ownership and replacement in the guide’s publication branches. It does not establish browser discovery support or approve an HTTP management exposure, certificate exception or organization-wide proxy rollout.\nApplicability questions\n\nWho owns the existing WPAD host and domain TXT records?\nWhich DHCP-configured domains are included in the proposed automatic branch?\nWhat other documented use depends on those TXT records?\nWill the plan use automatic publication or an explicitly maintained manual record?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends exporting the current relevant DNS records before selecting the automatic option. Put the WPAD host, domain TXT population, intended PAC location and responsible DNS owner in one review. Ask the owner to identify existing uses, including mail-policy dependencies, rather than assuming the domain records are dedicated to proxy discovery.\nCompare the guide’s automatic publication scope with the actual DHCP domain list. Mark every proposed replacement and resolve ownership conflicts before enabling the option. Where automatic replacement is unsuitable, assess the documented manual branch with the DNS owner instead of trying to repair unrelated records after the change.\nUse a disposable test domain or another expressly approved isolated scope for the first review. Prepare a before-and-expected record set that retains the domain’s required non-WPAD purposes. Keep browser behavior, PAC hosting and management-interface exposure as separate assessments; do not solve an ownership conflict by casually weakening those controls.\nAssign responsibility for future PAC-location and domain changes. Preserve a recovery copy of the original records and specify who can restore them. Require a second reviewer to reconcile the selected publication branch with the proposed record set before authorizing a production DNS modification.\nVerification and evidence\nProposed verification: compare the relevant DNS answers and authoritative configuration before and after the isolated change. Record which WPAD host and TXT entries actually changed, including any unexpected deletion or replacement. Check the owner’s other required TXT uses against the approved record set rather than accepting PAC discovery alone.\nHave another operator follow the written branch selection and locate the resulting PAC reference. Record discovery observations separately from a browser or proxy acceptance test. Restore the isolated scope through the approved cleanup procedure and retain the record comparison, ownership decision and unresolved dependencies with the change request.\nOfficial references\n\nOPNsense — Setup WPAD / PAC — official product documentation; confirm the installed release and configuration.\n\nSource review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change.", "datePublished": "2026-10-30T06:04:48+00:00", "dateModified": "2026-10-30T06:05:13+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review WPAD DNS replacement before enabling automatic publication" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 535, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OPNsense — Setup WPAD / PAC", "url": "https://docs.opnsense.org/manual/how-tos/pac.html" } } ] } }