The most common PAC file mistakes in real files
Which mistakes do real PAC files contain? Anonymous statistics from files checked with this tester since 2025. Most problems fall into a few patterns that are easy to fix.
How these figures are made
- No PAC file and no file content is published. The figures are only logical metrics: which rules found something, as anonymous, rounded shares of the files checked with this tester since 2025.
- There are no names, no addresses and no counts.
- Each file was rated with the current rule catalogue.
- All figures are approximate and for information only.
- More figures: PAC file statistics.
About a third of the files do not parse
A browser cannot run such a file. It connects directly, without a message (PAC-E001). Common causes: a missing brace, code outside the function, a quote that is never closed. The tester shows the line and the reason. All further figures are about the files that parse.
Three out of four files get a C or worse
| Grade | Share of the files that parse |
|---|---|
| A+ or A | about 2% |
| A- | about 15% |
| B | about 8% |
| C | about 38% |
| D | about 7% |
| E | about 26% |
| F | about 4% |
The grade reflects the most serious findings; the methodology page explains it.
The mistakes, from the most to the least common
| Mistake | Share | Rules |
|---|---|---|
| Host compared without lower-casing it first | about 73% | PAC-K009 |
| A DNS lookup before the rules that need none, so every request waits | about 52% | PAC-P001, PAC-P002 |
| A host pattern that also matches look-alike domains | about 49% | PAC-X003, PAC-X004, PAC-X009, PAC-X002 |
| For some addresses, the script throws, returns nothing or returns an invalid value | about 38% | PAC-E006, PAC-E011, PAC-X001, PAC-E010 |
The route depends on myIpAddress() | about 26% | PAC-K013 |
| The same condition twice | about 26% | PAC-C013 |
| An IP range matched as text, or with the wrong mask | about 22% | PAC-X006, PAC-C007 |
A host pattern applied to url instead of host | about 18% | PAC-C001 |
Upper-case host names miss every rule
Most files compare host with lower-case text but never call host = host.toLowerCase();. Chrome
and Firefox pass the host in lower case, but Windows services pass it as typed, so Intranet.Corp.Example
misses every rule there (PAC-K009). One line at the top of the function
fixes it.
DNS lookups make every request wait
isInNet(host, …) with a host name and dnsResolve(host) ask the DNS server before they can answer.
When such a test comes first, every request waits for that lookup, and a slow or unreachable resolver
slows down the whole browser. Test the name with dnsDomainIs or shExpMatch first and keep the DNS
tests for what is left (DNS in PAC files).
Look-alike domains slip through
shExpMatch(host, "*corp.example") and dnsDomainIs(host, "corp.example") also match
evilcorp.example, because there is no dot before the name. In a file that sends trusted domains
direct, anyone who registers such a domain bypasses the proxy. Use ".corp.example" with
dnsDomainIs, or "*.corp.example" together with host == "corp.example".
The script fails for some addresses
In more than a third of the files, at least one address makes the script throw an exception, return
nothing, or return a text the browser cannot use, such as two proxies without the ; between them.
Chrome and Firefox then connect directly, and Windows programs also reject lower-case keywords such as
proxy (PAC-E011). A single unconditional return as the last
statement and upper-case keywords prevent most of these cases.
Rules that depend on the user’s network
A quarter of the files decide by myIpAddress(). That gives different answers at home, in the office
and on VPN, and on machines with several network adapters
(PAC-K013). The tester lets you set the client address to check each case.
Check your own file
Paste your file into the online PAC file tester and press Check. It finds every mistake on this page, shows the line and grades the file. The pages PAC file troubleshooting and the 20 most dangerous PAC mistakes explain the fixes in more detail.
Frequently asked questions
What is the most common reason a proxy.pac does not work?
A syntax error. About a third of the checked files did not parse. Common causes are a missing brace, code outside the function and a quote that is never closed. A browser that cannot parse the file connects directly, without a message.
How common are look-alike domain patterns in PAC files?
About half of the files that parse have one. Examples are shExpMatch(host, "*corp.example") and dnsDomainIs(host, "corp.example") without a leading dot. Both also match evilcorp.example.
Do many PAC files slow down every request with DNS lookups?
Yes, about half of the files that parse. They call isInNet with a host name, or dnsResolve, before the rules that need no DNS. Test the name with dnsDomainIs or shExpMatch first.
How do I check my own PAC file for these mistakes?
Paste it into the tester at findproxyforurl.net/check/ and press Check. It reports each mistake with the line and grades the file from A+ to F. The file runs in your browser.