wpad handling

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

Windows (and maybe other software, too) sends a dns query for wpad or wpad.localdomain (maybe wpad.*) at least every few minutes.

The query is (usually) unnecessary, gives away the local domain name to the dns server, would allow a malicious dns server to configure your proxy, or maybe resolves to an existing domain, which again might be malicious, given its name.

Why isn't this auto blocked by DNSCrypt-Proxy?

[jedisct1]

Neither wpad nor wpad.localdomain are sent to upstream servers by default.

The former is blocked by block_unqualified, the latter by block_undelegated.

And if such a query reaches a DNSCrypt proxy, it will also be blocked by the proxy (encrypted-dns-server) itself, so upstream servers don't see it.

And for custom domains, local zones should be forwarded to the local router anyway. This is the purpose of the forwarder plugin.

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

Neither wpad nor wpad.localdomain are sent to upstream servers by default.

Sorry, I didn't meant localdomain literally but just the local domain which is a valid address and therefore sends wpad.example.com to the upstream server.

And for custom domains, local zones should be forwarded to the local router anyway. This is the purpose of the forwarder plugin.

The only thing this accomplishes is leaking queries to the ISP as it blocks any local requests.

[lifenjoiner]

Besides the defending feature, is your Web Proxy Auto-Discovery (WPAD) turned on?
My Windows does not send any WPAD requests. Check it following: https://answers.microsoft.com/en-us/windows/forum/all/what-is-wpadhome-repeating-messages/c62bebfb-d992-41fc-a8ab-2e8ad91ac63c.
WPAD is useful for intranet.

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

What did you do to achieve this? I think NetBIOS needs to be deactivated or configured for that.

[lifenjoiner]

Nothing special. I don't think it is on by default.
There must be some app adopting this WPAD in your environment. And, refer to https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol.
If the above link doesn't work, you may dig it out yourself. Try packet capturing and network status monitoring tools, like Wireshark and netstat, get which port the query is sent from, and then which program used that port.

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

It's WinHttpAutoProxySvc which is used by the DHCP-Client.

[lifenjoiner]

Not used by. It depends on (uses) DHCP-Client.

Show the results of:

reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoDetect
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings
netsh winhttp show proxy

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

1. doesn't exist
2. F.......................................................
3. direct access

[c3d1c06c-bf26-477e-b0eb-c50ef4477ba6]

@lifenjoiner

1. Does your router (or anything else) serve a wpad.dat file?
2. Is NCSI enabled?