# Review WPAD DNS replacement before enabling automatic publication > Check existing WPAD host and domain TXT records before choosing the guide’s automatic Unbound publication branch. - Canonical URL: https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-30T06:04:48+00:00 - Modified: 2026-10-30T06:05:13+00:00 - Last reviewed by DSE: 2026-10-30 - Resource type: Guide - DSE priority: Advisory - Topics: Cybersecurity, Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Check existing WPAD host and domain TXT records before choosing the guide’s automatic Unbound publication branch. ## Potentially affected OPNsense WPAD deployments considering automatic DNS publication through Unbound. ## DSE recommendation Compare existing DNS records with the documented replacement behavior before enabling automatic WPAD publication. ## Article Bottom line: Review the existing host and TXT records before selecting automatic WPAD publication. Preserve the domain’s other DNS purposes and choose an explicitly reviewed publication branch. ## Source fact: what the authority says The [OPNsense WPAD/PAC guide](https://docs.opnsense.org/manual/how-tos/pac.html) says WPAD discovers the PAC file for a domain. Its automatic Unbound branch overwrites the domain’s WPAD host and TXT records and warns that this can break other TXT uses such as SPF. The same branch defines hosts for DHCP-configured domains as aliases of the firewall host and publishes the PAC URL through TXT records. The guide also documents a manual DNS host override for wpad, using an A or AAAA record and the OPNsense web-interface address. ## What the source does not establish This article addresses DNS ownership and replacement in the guide’s publication branches. It does not establish browser discovery support or approve an HTTP management exposure, certificate exception or organization-wide proxy rollout. ## Applicability questions - Who owns the existing WPAD host and domain TXT records? - Which DHCP-configured domains are included in the proposed automatic branch? - What other documented use depends on those TXT records? - Will the plan use automatic publication or an explicitly maintained manual record? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends exporting the current relevant DNS records before selecting the automatic option. Put the WPAD host, domain TXT population, intended PAC location and responsible DNS owner in one review. Ask the owner to identify existing uses, including mail-policy dependencies, rather than assuming the domain records are dedicated to proxy discovery. Compare the guide’s automatic publication scope with the actual DHCP domain list. Mark every proposed replacement and resolve ownership conflicts before enabling the option. Where automatic replacement is unsuitable, assess the documented manual branch with the DNS owner instead of trying to repair unrelated records after the change. Use a disposable test domain or another expressly approved isolated scope for the first review. Prepare a before-and-expected record set that retains the domain’s required non-WPAD purposes. Keep browser behavior, PAC hosting and management-interface exposure as separate assessments; do not solve an ownership conflict by casually weakening those controls. Assign responsibility for future PAC-location and domain changes. Preserve a recovery copy of the original records and specify who can restore them. Require a second reviewer to reconcile the selected publication branch with the proposed record set before authorizing a production DNS modification. ## Verification and evidence Proposed verification: compare the relevant DNS answers and authoritative configuration before and after the isolated change. Record which WPAD host and TXT entries actually changed, including any unexpected deletion or replacement. Check the owner’s other required TXT uses against the approved record set rather than accepting PAC discovery alone. Have another operator follow the written branch selection and locate the resulting PAC reference. Record discovery observations separately from a browser or proxy acceptance test. Restore the isolated scope through the approved cleanup procedure and retain the record comparison, ownership decision and unresolved dependencies with the change request. ## Official references - [OPNsense — Setup WPAD / PAC](https://docs.opnsense.org/manual/how-tos/pac.html) — official product documentation; confirm the installed release and configuration. Source review completed October 30, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: OPNsense — Setup WPAD / PAC - Authority: docs.opnsense.org - URL: https://docs.opnsense.org/manual/how-tos/pac.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Review WPAD DNS replacement before enabling automatic publication,” DSE Security, https://update.dsesecurity.com/updates/review-wpad-dns-replacement-before-enabling-automatic-publication/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.