Handling DNS Failure Inside a PAC Rule

Give a failed PAC DNS lookup its own policy branch instead of treating it as a verified address outside the local network.

A failed lookup does not prove that a destination is outside your private network. It proves that this PAC evaluation did not obtain the address it needed.

That distinction matters when dnsResolve() feeds an isInNet() rule. Chromium's PAC implementation returns null when resolution fails. Do not build the failure branch around a remembered claim that the result is always an empty string.

function FindProxyForURL(url, host) {
    var address = dnsResolve(host);
    if (!address) {
        return "PROXY proxy.example:8080";
    }
    if (isInNet(address, "10.40.0.0", "255.255.0.0")) {
        return "DIRECT";
    }
    return "PROXY proxy.example:8080";
}

This example sends unresolved names to the proxy. That is a policy choice, not a universal safe default. It can be useful when the proxy has a resolver or network view unavailable to the client. A network requiring local resolution needs a different explicit outcome.

Resolve once and reuse the result. That keeps the decision tied to one value and avoids repeating potentially slow helper calls.

Also check the actual PAC consumer. Legacy IPv4 helpers and extended IPv6 helpers have different contracts. A rule tested with one browser's implementation does not establish support in every application using the same PAC URL.

If the requirement is simply to route a known company suffix, a hostname rule may avoid the lookup entirely. Reach for address-based classification when the address is information the policy truly needs.

Related articles