Feb 022010

Due to security reasons WPAD and ISATAP have been by default blocked in Windows server 2008 DNS. There is a GlobalQueryBlockList which blocks these entries. When you try to create a WPAD entry to configure your ISA Auto Discovery, it will fail to resolve the WPAD entry whereas it will resolve the WSPAD entry. This can be quite problematic when you using the WPAD DNS entry rather then the DHCP possibility.

To remove the WPAD from the block list type the following command:
Dnscmd /config /globalqueryblocklistisatap

This command will override the existing list with ISATAP as the only keyword.
Now, you can resolve the WPAD entry from NSLOOKUP

Check DNS Server Global Query Block List from the Microsoft website for more details about DNS