A Missing PAC File Can Change Your Exit IP
If a browser cannot fetch its proxy script, its fallback behavior may differ from the DIRECT rules inside a successfully loaded script.
Removing every DIRECT branch from a PAC file does not necessarily control what the browser does when it cannot obtain the file at all.
| Failure point | Relevant policy |
|---|---|
| A loaded script chooses among returned proxies | The ordered candidate list, including any explicit DIRECT option. |
| The browser cannot fetch a usable script | The client's configuration fallback, including any usable cache or manual alternative. |
Chromium documents a next configuration after PAC fetch failure: a manual proxy on supported platforms, or direct access. A mandatory PAC configuration prevents its documented direct fallback when set through a supported mechanism. This does not define every browser, platform or cached-script situation.
For an unexpected direct exit, keep the client/version and effective managed or extension policy with the PAC URL, retrieval result, observed exit and network-change time. Note whether a cached script or manual proxy existed. Pair proxy logs with client routing evidence; a proxy cannot log a request that never reached it.
An organization requiring approved egress must align browser policy with network access policy. A script that usually returns the right endpoint cannot alone guarantee the same path while its delivery server is unavailable.