PAC file: route one domain through a proxy on Mac

You need a proxy for one site, but a Mac proxy setting can affect more apps and destinations than you intended. A proxy PAC file gives supported clients a small rule that chooses a route for each request. This example routes example.com and its subdomains through a proxy, leaves other hosts direct, and avoids a hostname suffix bug.

What is a PAC file?

A PAC (proxy auto-config) file is a JavaScript file that defines FindProxyForURL(url, host). The browser or network client calls it to get a proxy choice for a URL. The return string can name a proxy, choose DIRECT, or list fallbacks separated by semicolons, as MDN’s 2026 PAC reference describes.

The common return forms are PROXY proxy.example.net:8080 for an HTTP proxy and DIRECT for a direct connection. MDN and Chromium’s proxy docs both document SOCKS5 host:port, but not every PAC client does, so test that token in yours. A list such as PROXY proxy.example.net:8080; DIRECT means the client may try a direct connection if it can’t use the proxy. Keep that fallback only if direct access is acceptable.

The PAC function decides where to send a request. It doesn’t create the proxy server or make a destination reachable. Replace the example proxy host and port with values supplied by your proxy provider or administrator. MDN’s 2026 PAC guidance recommends the .pac extension and the application/x-ns-proxy-autoconfig MIME type for a hosted file. The rule here uses only string matching. Unlike helpers such as dnsResolve, it needs no DNS lookup to make its decision.

How do I proxy one domain and its subdomains?

Check the exact host first, then test for a suffix that begins with a dot. A raw endsWith("example.com") also matches notexample.com. The leading dot makes the boundary explicit. MDN’s 2026 dnsDomainIs reference defines a domain-suffix check and demonstrates .mozilla.org for subdomains.

Save this PAC file example as proxy.pac:

function FindProxyForURL(url, host) {
	if (host === 'example.com' || dnsDomainIs(host, '.example.com')) {
		return 'PROXY proxy.example.net:8080; DIRECT';
	}
	return 'DIRECT';
}

The cases below were run through a Node harness that implements the PAC helper used here. This checks the routing logic, not Safari, Chrome, or a live proxy connection.

Host	Result
example.com	PROXY proxy.example.net:8080; DIRECT
www.example.com	PROXY proxy.example.net:8080; DIRECT
notexample.com	DIRECT
example.com.evil.net	DIRECT
elsewhere.test	DIRECT

For another host, add it to the test matrix and check the result in the browser you use: clients don’t expose identical inputs or support every return token the same way. Test both the bare domain and a real subdomain from your own list. A PAC can route one hostname while leaving another hostname used by the site direct, so list every site the job actually needs and test those too.

How do I install a PAC file on macOS 27?

macOS proxy settings live in Apple menu → System Settings → Network → [your network service] → Details → Proxies on macOS 27; turn on Automatic proxy configuration and enter the PAC address in the URL field. This is Apple’s current path, checked October 2026. The service matters because the setting is attached to that network service.

Apple’s 2026 Mac proxy guide asks for the PAC file’s address without promising every URL scheme. The Apple 2026 GlobalHTTPProxy profile reference says managed PAC URLs on macOS 10.15 and later must begin with http:// or https://. Apple also deprecated cleartext HTTP PAC URLs in Apple’s macOS Monterey 12 release notes (2021), recommending HTTPS.

For a Mac system setting, use an HTTPS-hosted PAC file unless your administrator gives you a different supported setup.

Mozilla’s 2026 Firefox connection guide explicitly documents file: URLs for its own PAC setting. That doesn’t establish that a local file:// path works through macOS System Settings or every browser. For the system setting, follow Apple’s URL field and prefer HTTPS. For Firefox-only configuration, its current guide lists local file: as an option.

Which browsers use the Mac’s PAC setting?

Safari and Chrome can use the macOS network proxy configuration, so a proxy for Safari is set there: Apple’s 2026 Safari proxy guide opens Network settings from its Proxies control. Chromium’s 2026 network-settings guide says its network stack uses system network settings. Chromium’s 2026 proxy guide also lists policy, command-line options, and extensions as possible sources of a different Chrome proxy configuration.

Firefox has its own connection setting. In current Firefox, open Settings, select Privacy and security, go to Connection and software security, click Advanced settings, then Configure proxy under Proxy settings. Choose Use system proxy settings to follow macOS, or Automatic proxy configuration URL to load a PAC specifically in Firefox. Mozilla also documents a Reload button for the selected PAC. Menu names checked October 2026 in Mozilla’s connection settings guide.

A practical check: test the same target in Safari, Chrome, and Firefox after configuring the Mac. If Firefox is set to No proxy or Use system proxy settings is off, a working macOS PAC alone won’t route its traffic. A browser policy or command-line override can similarly make Chrome behave differently from the system setting.

PAC file, system proxy, or per-site settings?

Use a PAC file when you need rules by hostname and the apps that matter honor the configured PAC. Choose a fixed system proxy when most supported traffic should take the same route. Choose per-app or per-site settings when one application or a short site list needs a separate route and central PAC logic would be unnecessary.

Option	What it routes	Best fit	Trade-off
PAC file	Requests according to JavaScript rules	Several domain rules across apps that honor the Mac setting	Browser behavior and refresh timing can differ
Fixed system proxy	Traffic covered by the configured proxy, with any bypass list	One route for most supported destinations	Broader than one site; each app must honor system settings
Per-app or per-site proxy	Only the app or site rules you configure	One app or a few named sites	Settings may need to be repeated per app

I build Octoweb, so weigh that accordingly. Octoweb’s Settings → Proxies routes only the sites you list through a proxy. You enter sites, not a script. Its match for example.com includes subdomains but excludes notexample.com and example.com.evil.net; it requires macOS 14 or later. If you want a graphical per-site setup, the Octoweb browser page describes the product.

Why did my PAC change not take effect?

First confirm the request is reaching the PAC you edited, then account for the client’s cache. Chromium documents that Chrome doesn’t use the ordinary HTTP cache for PAC files: after a successful fetch, it treats the script as fresh until the network changes or 12 hours pass. To refresh Chrome’s proxy state during a check, open chrome://net-internals/#proxy and use Re-apply settings. Chromium’s 2026 proxy guide also documents explicit PAC invalidation there.

Then check three common mistakes: the PAC response isn’t valid JavaScript, the proxy hostname or port is wrong, or the DIRECT fallback makes a failed proxy look like a successful page load.

Confirm that the PAC URL is reachable on the network where you’re testing. Chromium’s 2026 proxy guide says Chrome fetches the PAC before resolving requests, and a fetch can stall proxy resolution. On macOS, Apple’s 2026 GlobalHTTPProxy profile reference also requires an HTTP or HTTPS PAC URL, so a file:// path that works in Firefox isn’t a safe assumption for a managed Mac.

If only HTTPS paths appear to ignore your PAC rules in Chrome, Chromium’s 2026 proxy guide says Chrome strips the path and query from HTTPS URLs before PAC evaluation, so path-specific routing isn’t a portable way to split HTTPS destinations. MDN’s 2026 PAC reference also notes that the host argument carries no port number.

The tested function above should proxy only example.com and its subdomains. If your actual policy must never allow direct access, remove ; DIRECT and test the failure behavior in each target client before relying on the rule.

For a route through your own SSH server, see the Mac guide to routing one site through an SSH SOCKS proxy.