[PAC File Troubleshooting] Not Updating / Sending One Site Direct… Common Pitfalls in Q&A

Proxy PAC files are handy, but in practice you hit surprisingly many snags: "I changed it but nothing happens," "I want just one site to go direct," "it doesn't work at all." This article collects the troubles you commonly meet, in Q&A form. The basics are covered in our earlier intro article, so please read that too.

Previous: Proxy PAC file (with sample) →

*This article introduces technical examples. Behavior varies by browser, OS, and network. Each Q&A includes an affiliate link (Amazon Associates) to a related book.

Q1　The PAC file won't update after I changed it

A. This is the most common one. The usual cause is caching. Browsers and OSes cache the PAC file for a while, so updates may not take effect immediately. Internet Explorer in particular caches the auto-proxy script internally.

Fixes: fully restart the browser; append a version query to the PAC URL (e.g. proxy.pac?v=2) so it's seen as a "new file"; adjust the Cache-Control header on the serving side. In IE you can disable auto-proxy script caching via Group Policy.

Point　When "I fixed it but it's still broken," suspect the cache first. Adding a query to the URL is a quick way to isolate it.

Related book (PR)　For learning about serving and cache control.　▶ Find on Amazon

Q2　I want just a specific site to go direct, bypassing the proxy

A. Use shExpMatch to check the host and return DIRECT when it matches. Rules are evaluated top-down and stop at the first match, so put sites you want to exclude near the top.

function FindProxyForURL(url, host) {
  // send only this domain direct
  if (shExpMatch(host, "*.example.com")) {
    return "DIRECT";
  }
  // everything else via proxy
  return "PROXY proxy.example.com:8080";
}

Point　shExpMatch uses wildcards (shell-style), not regular expressions. Write it like "*.example.com".

Related book (PR)　A PAC file is JavaScript — solidify the basics.　▶ Find on Amazon

Q3　Internal systems direct, external sites via proxy

A. For intranet detection, combine isPlainHostName (hosts without a dot), dnsDomainIs (internal domain), and isInNet (IP range). Internal goes DIRECT, everything else via proxy — a classic pattern.

function FindProxyForURL(url, host) {
  // internal / intranet goes direct
  if (isPlainHostName(host) ||
      dnsDomainIs(host, ".corp.local") ||
      isInNet(host, "10.0.0.0", "255.0.0.0")) {
    return "DIRECT";
  }
  // otherwise external proxy
  return "PROXY proxy.example.com:8080";
}

Point　isInNet and dnsResolve require DNS lookups and tend to cause delays. Prefer string checks (like shExpMatch) when possible.

Related book (PR)　For designing and building internal networks.　▶ Find on Amazon

Q4　The PAC file doesn't work at all / isn't loaded

A. Suspect three things. (1) Syntax errors — a single missing semicolon, misspelled function, or mismatched bracket stops the whole script. (2) Delivery — is the PAC URL reachable, or blocked by a firewall? (3) MIME type — serve .pac as application/x-ns-proxy-autoconfig to be safe.

Point　Recent browsers may restrict PAC files placed via file://. Serving over HTTP(S) is the reliable approach.

Related book (PR)　For isolating and investigating connection issues.　▶ Find on Amazon

Q5　Auto-switch when a proxy goes down (failover)

A. Specify multiple return values separated by semicolons; they're tried left to right, falling back to the next if there's no response. Put DIRECT last to switch to direct when all proxies fail.

function FindProxyForURL(url, host) {
  // try proxy1 -> proxy2 -> direct
  return "PROXY proxy1.example.com:8080; " +
         "PROXY proxy2.example.com:8080; DIRECT";
}

Related book (PR)　For learning server redundancy and load balancing.　▶ Find on Amazon

Q6　Works only in some browsers / breaks if the port is omitted

A. An easy miss is omitting the port. Writing "PROXY proxy.example.com" without a port fails in some browsers (the Firefox family). Even for the default 80, always write ":80". Also, the DIRECT and PROXY keywords are uppercase (case-sensitive).

Point　For https URLs, the path and query are stripped before reaching the PAC — only the host remains. If you need to route by detailed path, note that you can't for https.

Related book (PR)　For digging into HTTP and protocol internals.　▶ Find on Amazon

Q7　How to test and debug a PAC file?

A. Before rolling out company-wide, verify locally. Tools like pactester show which proxy a given URL is routed to. The basic isolation step is to set the proxy directly in the browser first and confirm you can communicate with PAC removed. Then add PAC conditions one at a time to pinpoint the cause.

Point　myIpAddress can return unexpected values depending on the environment (multiple NICs, VPN), so it's safer to avoid it.

Related book (PR)　For strengthening practical network operations.　▶ Find on Amazon

---

Wrap-up

PAC file troubles usually come down to "cache stops updates," "a syntax error halts everything," and "omitting the port breaks some browsers." When stuck, first set the proxy directly in the browser to isolate, then add PAC conditions back one by one. The basics are in our earlier intro article.

Robin Planning can help　We also handle setup and troubleshooting for internal networks and proxies. Feel free to reach out.

---

Disclaimer: This article is a technical memo for general information and does not guarantee behavior. Behavior varies by browser, OS, and network. Affiliate: Robin Planning participates in the Amazon Associates Program and may earn referral fees from purchases via links on this site.