# The most common PAC file mistakes in real files

Source: https://findproxyforurl.net/articles/common-pac-file-mistakes/ · last updated 2026-10-12

Which mistakes do real PAC files contain? Anonymous statistics from files checked with this tester since 2025. Most problems fall into a few patterns that are easy to fix.

## How these figures are made

- No PAC file and no file content is published. The figures are only logical metrics: which rules
  found something, as anonymous, rounded shares of the files checked with this tester since 2025.
- There are no names, no addresses and no counts.
- Each file was rated with the current [rule catalogue](https://findproxyforurl.net/rules/).
- All figures are approximate and for information only.
- More figures: [PAC file statistics](https://findproxyforurl.net/statistics/).

## About a third of the files do not parse

A browser cannot run such a file. It connects directly, without a message
([PAC-E001](https://findproxyforurl.net/rules/syntax-error/)). Common causes: a missing brace, code outside the function, a quote
that is never closed. The tester shows the line and the reason. All further figures are about the
files that parse.

## Three out of four files get a C or worse

| Grade | Share of the files that parse |
|---|---|
| A+ or A | about 2% |
| A- | about 15% |
| B | about 8% |
| C | about 38% |
| D | about 7% |
| E | about 26% |
| F | about 4% |

The grade reflects the most serious findings; the [methodology](https://findproxyforurl.net/methodology/) page explains it.

## The mistakes, from the most to the least common

| Mistake | Share | Rules |
|---|---|---|
| Host compared without lower-casing it first | about 73% | [PAC-K009](https://findproxyforurl.net/rules/host-not-lowercased/) |
| A DNS lookup before the rules that need none, so every request waits | about 52% | [PAC-P001](https://findproxyforurl.net/rules/dns-function-on-hot-path/), [PAC-P002](https://findproxyforurl.net/rules/isinnet-on-hostname/) |
| A host pattern that also matches look-alike domains | about 49% | [PAC-X003](https://findproxyforurl.net/rules/dnsdomainis-without-leading-dot/), [PAC-X004](https://findproxyforurl.net/rules/shexpmatch-leading-asterisk-without-dot/), [PAC-X009](https://findproxyforurl.net/rules/unanchored-substring-pattern/), [PAC-X002](https://findproxyforurl.net/rules/shexpmatch-trailing-asterisk/) |
| For some addresses, the script throws, returns nothing or returns an invalid value | about 38% | [PAC-E006](https://findproxyforurl.net/rules/runtime-exception/), [PAC-E011](https://findproxyforurl.net/rules/invalid-return-value/), [PAC-X001](https://findproxyforurl.net/rules/no-default-return/), [PAC-E010](https://findproxyforurl.net/rules/isinnet-invalid-arguments/) |
| The route depends on `myIpAddress()` | about 26% | [PAC-K013](https://findproxyforurl.net/rules/myipaddress-usage/) |
| The same condition twice | about 26% | [PAC-C013](https://findproxyforurl.net/rules/duplicate-condition/) |
| An IP range matched as text, or with the wrong mask | about 22% | [PAC-X006](https://findproxyforurl.net/rules/rfc1918-string-pattern/), [PAC-C007](https://findproxyforurl.net/rules/wrong-rfc1918-mask/) |
| A host pattern applied to `url` instead of `host` | about 18% | [PAC-C001](https://findproxyforurl.net/rules/url-instead-of-host/) |

### Upper-case host names miss every rule

Most files compare `host` with lower-case text but never call `host = host.toLowerCase();`. Chrome
and Firefox pass the host in lower case, but Windows services pass it as typed, so `Intranet.Corp.Example`
misses every rule there ([PAC-K009](https://findproxyforurl.net/rules/host-not-lowercased/)). One line at the top of the function
fixes it.

### DNS lookups make every request wait

`isInNet(host, …)` with a host name and `dnsResolve(host)` ask the DNS server before they can answer.
When such a test comes first, every request waits for that lookup, and a slow or unreachable resolver
slows down the whole browser. Test the name with `dnsDomainIs` or `shExpMatch` first and keep the DNS
tests for what is left ([DNS in PAC files](https://findproxyforurl.net/articles/dns-in-pac-files/)).

### Look-alike domains slip through

`shExpMatch(host, "*corp.example")` and `dnsDomainIs(host, "corp.example")` also match
`evilcorp.example`, because there is no dot before the name. In a file that sends trusted domains
direct, anyone who registers such a domain bypasses the proxy. Use `".corp.example"` with
`dnsDomainIs`, or `"*.corp.example"` together with `host == "corp.example"`.

### The script fails for some addresses

In more than a third of the files, at least one address makes the script throw an exception, return
nothing, or return a text the browser cannot use, such as two proxies without the `;` between them.
Chrome and Firefox then connect directly, and Windows programs also reject lower-case keywords such as
`proxy` ([PAC-E011](https://findproxyforurl.net/rules/invalid-return-value/)). A single unconditional `return` as the last
statement and upper-case keywords prevent most of these cases.

### Rules that depend on the user's network

A quarter of the files decide by `myIpAddress()`. That gives different answers at home, in the office
and on VPN, and on machines with several network adapters
([PAC-K013](https://findproxyforurl.net/rules/myipaddress-usage/)). The tester lets you set the client address to check each case.

## Check your own file

Paste your file into the [online PAC file tester](https://findproxyforurl.net/check/) and press **Check**. It finds every mistake
on this page, shows the line and grades the file. The pages
[PAC file troubleshooting](https://findproxyforurl.net/articles/pac-file-troubleshooting/) and
[the 20 most dangerous PAC mistakes](https://findproxyforurl.net/top-20/) explain the fixes in more detail.


## Frequently asked questions

### What is the most common reason a proxy.pac does not work?

A syntax error. About a third of the checked files did not parse. Common causes are a missing brace, code outside the function and a quote that is never closed. A browser that cannot parse the file connects directly, without a message.

### How common are look-alike domain patterns in PAC files?

About half of the files that parse have one. Examples are shExpMatch(host, "*corp.example") and dnsDomainIs(host, "corp.example") without a leading dot. Both also match evilcorp.example.

### Do many PAC files slow down every request with DNS lookups?

Yes, about half of the files that parse. They call isInNet with a host name, or dnsResolve, before the rules that need no DNS. Test the name with dnsDomainIs or shExpMatch first.

### How do I check my own PAC file for these mistakes?

Paste it into the tester at findproxyforurl.net/check/ and press Check. It reports each mistake with the line and grades the file from A+ to F. The file runs in your browser.