Local DNS resolution when PAC file is configured

[Venkatesh7791]

Hi Team,

Our Windows machine is configured with PAC file and automatic configuration script option is checked and internet traffic is going via Proxy server located in the on premise only. Both internet and intranet access work perfectly. We dont have any issues accessing intranet sites but while trying to access internet websites we are facing a slowness issue due to Local DNS server is not able to resolve IPs for external domains. However every time the internet site is loaded, Edge/Chrome performs local DNS resolution which fails as our local DNS is not able to resolve internet sites. Then the request goes to proxy server and the site loads correctly.

As per Microsoft link, only the following three functions isInNet(), isResolvable(), and dnsResolve() functions send queries to the DNS-subsystem. Therefore, you should avoid, or, at least, minimize the use of these functions.

But in the PAC file we do have this along with other functions. Please see the pac file content below.

The question is whether it is possible to prevent Client machine in performing local DNS resolution if the request is supposed to go to proxy server.

If the request is supposed to go via onpremise proxy then why client is sending DNS query to Local DNS Server?

Whether it is expected and intended behavior of PAC files or Operating systems?

Any thoughts on this?

Regards,

Venkatesh

[#2]

//pacfile for 157.51.199.175 from 658421_1264:1_2511
// Ntw: --
var atyps = new Array("authservice.", "formauth.");
function FindProxyForURL(url, host)
{
var proxy_addresses;
var hosted;

/* Convert the host parameter to lowercase
to facilitate case insensitive matching.
*/
host = host.toLowerCase();


proxy_addresses = 'PROXY ipv4.157.51.199.175.hybrid-web.proxyfqdn.com:8080';
if ('' == 'Network_111111')
{
if (url.substring(0, 5) == 'http:')
{
proxy_addresses = 'PROXY 10.1.1.1:8080; PROXY 10.1.1.2:8080; PROXY 10.1.1.3:8080';
}
if (url.substring(0, 6) == 'https:')
{
proxy_addresses = 'PROXY 10.1.1.1:8080; PROXY 10.1.1.2:8080; PROXY 10.1.1.3:8080';
}
if (url.substring(0, 4) == 'ftp:')
{
proxy_addresses = 'PROXY 10.1.1.1:21; PROXY 10.1.1.2:21; PROXY 10.1.1.3:21';
}
}
if ('' == 'Network_111112')
{
if (url.substring(0, 5) == 'http:')
{
proxy_addresses = 'PROXY 10.1.1.1:8080; PROXY 10.1.1.2:8080; PROXY 10.1.1.3:8080';
}
if (url.substring(0, 6) == 'https:')
{
proxy_addresses = 'PROXY 10.1.1.1:8080; PROXY 10.1.1.2:8080; PROXY 10.1.1.3:8080';
}
if (url.substring(0, 4) == 'ftp:')
{
proxy_addresses = 'PROXY 10.1.1.1:21; PROXY 10.1.1.2:21; PROXY 10.1.1.3:21';
}
}

hosted = (proxy_addresses == 'PROXY ipv4.157.51.199.175.hybrid-web.proxyfqdn.com:8080');

/* Don't proxy local hostnames */
if (isPlainHostName(host))
{
return 'DIRECT';
}

/* always proxy on normal service address/port for the login host */
if (shExpMatch(host, '*proxy-login.blackspider.com'))
{
// Examine and possibly replace the first proxy setting generated above.
prx_sect = proxy_addresses.split(';')[0]; // get 1st setting
if (!shExpMatch(prx_sect, 'PROXY *')) return proxy_addresses; // Not a proxy specifier, so don't change anything
// Verify that the proxy specifier is in the hosted domain by checking last 2 hostname components
std_host = 'ipv4.157.51.199.175.hybrid-web.proxyfqdn.com';
idx = std_host.search('\.[^.]+\.[^.]+$');
if (idx < 0) return proxy_addresses; // Not enough hostname components to check whether it is in hosted domain, so we should not change it
std_domain = std_host.substring(idx);
len_std_domain = std_domain.length;
prx_spec = prx_sect.split(' ',2)[1]; // discard 'PROXY ' part keeping host:port
prx = prx_spec.split(':')[0]; // split hostname from port
if (prx.substring(prx.length - len_std_domain) != std_domain) return proxy_addresses; // Not in hosted domain, so we should not change it
for (i in atyps)
{
// strip away auth-type prefix, if present, from hostname in order to use standard service
atyp = atyps[i];
if (prx.substring(0, atyp.length) == atyp) return 'PROXY ' + prx_spec.substring(atyp.length);
}
// Not an auth-type hostname, so change port number to access the standard service
return 'PROXY ' + prx + ':8080';
}

/* Don't proxy local domains */
var domain_list;
if ( hosted )
{
// Unfiltered destinations of type hybrid and both hybrid and explicit.
domain_list = new Array("");
}
else
{
// Unfiltered destinations of type explicit and both hybrid and explicit.
domain_list = new Array("");
}
for (d in domain_list)
{
if ( dnsDomainIs(host, "." + domain_list[d] ) || host == domain_list[d] )
{
return 'DIRECT';
}
}


/* Don't proxy Windows Update */
if ((host == "download.microsoft.com") ||
(host == "ntservicepack.microsoft.com") ||
(host == "cdm.microsoft.com") ||
(host == "officecdn.microsoft.com.edgesuite.net") ||
(host == "wustat.windows.com") ||
(host == "windowsupdate.microsoft.com") ||
(dnsDomainIs(host, ".windowsupdate.microsoft.com")) ||
(host == "update.microsoft.com") ||
(dnsDomainIs(host, ".update.microsoft.com")) ||
(dnsDomainIs(host, ".windowsupdate.com")) ||
(host == "officecdn.microsoft.com") ||
(host == "sci2-1.am.microsoft.com") ||
(dnsDomainIs(host, ".mp.microsoft.com")) ||
(dnsDomainIs(host, ".dl.ws.microsoft.com")) ||
(dnsDomainIs(host, ".delivery.mp.microsoft.com")) ||
(host == "query1.finance.yahoo.com") ||
(host == "query2.finance.yahoo.com") ||
(dnsDomainIs(host, "emdl.ws.microsoft.com")) ||
(dnsDomainIs(host, "adl.windows.com")) ||
(host == "swcdn.apple.com") ||
(host == "updates-http.cdn-apple.com") ||
(host == "updates.cdn-apple.com"))
{
return 'DIRECT';
}

/* Don't proxy Office 365 */
var domain_pattern_list = new Array("*.aadrm.com",
"*.aadrm.us",
"*.activity.windows.com",
"*.adl.windows.com",
"*.appex-rf.msn.com",
"*.aria.microsoft.com",
"*.assets-yammer.com",
"*.auth.microsoft.com",
"*.auth.microsoft.us",
"*.azure-apim.net",
"*.azureedge.net",
"*.azurerms.com",
"*.broadcast.skype.com",
"*.cdn.office.net",
"*.cdn.office365.us",
"*.compliance.apps.mil",
"*.compliance.microsoft.com",
"*.compliance.microsoft.us",
"*.cortana.ai",
"*.dod.online.office365.us",
"*.dod.teams.microsoft.us",
"*.dps.mil",
"*.ecdn.microsoft.com",
"*.events.data.microsoft.com",
"*.flow.microsoft.com",
"*.gov.online.office365.us",
"*.gov.skypeforbusiness.us",
"*.gov.teams.microsoft.us",
"*.gov.us.microsoftonline.com",
"*.hip.live.com",
"*.informationprotection.azure.com",
"*.informationprotection.azure.us",
"*.keydelivery.mediaservices.windows.net",
"*.lync.com",
"*.mail.protection.outlook.com",
"*.manage.microsoft.com",
"*.manage.office365.us",
"*.media.azure.net",
"*.microsoft.com",
"*.microsoftonline-p.com",
"*.microsoftonline.com",
"*.microsoftstream.com",
"*.microsoftusercontent.com",
"*.msauth.net",
"*.msauthimages.net",
"*.msauthimages.us",
"*.msecnd.net",
"*.msftauth.net",
"*.msftauthimages.net",
"*.msftauthimages.us",
"*.msftidentity.com",
"*.msidentity.com",
"*.msocdn.com",
"*.mstea.ms",
"*.od.apps.mil",
"*.office.com",
"*.office.net",
"*.office365.com",
"*.office365.us",
"*.officeapps.live.com",
"*.onenote.com",
"*.online.dod.skypeforbusiness.us",
"*.online.office.com",
"*.onmicrosoft.com",
"*.osi.apps.mil",
"*.osi.office365.us",
"*.outlook.com",
"*.outlook.office.com",
"*.outlookmobile.com",
"*.portal.cloudappsecurity.com",
"*.powerapps.com",
"*.protection.apps.mil",
"*.protection.office.com",
"*.protection.office365.us",
"*.protection.outlook.com",
"*.scc.office365.us",
"*.search.production.apac.trafficmanager.net",
"*.search.production.emea.trafficmanager.net",
"*.search.production.us.trafficmanager.net",
"*.secure.skypeassets.com",
"*.security.apps.mil",
"*.security.microsoft.com",
"*.security.microsoft.us",
"*.sfbassets.com",
"*.sharepoint-mil.us",
"*.sharepoint.com",
"*.sharepoint.us",
"*.sharepointonline.com",
"*.skype.com",
"*.skypeforbusiness.com",
"*.streaming.mediaservices.windows.net",
"*.svc.ms",
"*.teams.microsoft.com",
"*.users.storage.live.com",
"*.virtualearth.net",
"*.wns.windows.com",
"*.yammer.com",
"*.yammerusercontent.com",
"*cdn.onenote.net",
"account.activedirectory.windowsazure.com",
"account.live.com",
"account.office.net",
"accounts.accesscontrol.windows.net",
"activation.sls.microsoft.com",
"activity.windows.com",
"adelivery.mp.microsoft.com",
"admin.microsoft.com",
"admin.onedrive.com",
"admin.onedrive.us",
"adminwebservice.microsoftonline.com",
"ajax.aspnetcdn.com",
"aka.ms",
"amp.azure.net",
"api.passwordreset.microsoftonline.com",
"apis.live.net",
"appsforoffice.microsoft.com",
"assets.onestore.ms",
"attachments-dod.office365-net.us",
"attachments.office365-net.us",
"auth.gfx.ms",
"autodiscover-s-dod.office365.us",
"autodiscover-s.office365.us",
"autodiscover.*.mail.onmicrosoft.com",
"autodiscover.*.mail.onmicrosoft.us",
"autodiscover.*.onmicrosoft.com",
"autodiscover.*.onmicrosoft.us",
"autologon.microsoftazuread-sso.com",
"az741266.vo.msecnd.net",
"becws.microsoftonline.com",
"broadcast.skype.com",
"c.live.com",
"c1.microsoft.com",
"ccs.login.microsoftonline.com",
"cdn.odc.officeapps.live.com",
"cdn.uci.officeapps.live.com",
"cdnprod.myanalytics.microsoft.com",
"clientconfig.microsoftonline-p.net",
"companymanager.microsoftonline.com",
"compass-ssl.microsoft.com",
"compliance.apps.mil",
"compliance.microsoft.com",
"compliance.microsoft.us",
"config.apps.mil",
"crl.microsoft.com",
"d.docs.live.net",
"dc.services.visualstudio.com",
"defender.microsoft.com",
"device.login.microsoftonline.com",
"dgps.support.microsoft.com",
"directory.services.live.com",
"dl.delivery.mp.microsoft.com",
"docs.live.net",
"docs.microsoft.com",
"dod-graph.microsoft.us",
"dod-mtis.cortana.ai",
"dod.activity.windows.us",
"dod.loki.office365.us",
"dod.teams.microsoft.us",
"dodteamsapuiwebcontent.blob.core.usgovcloudapi.net",
"ecn.dev.virtualearth.net",
"emdl.ws.microsoft.com",
"endpoint1-proddodcecompsvc-dodc.streaming.media.usgovcloudapi.net",
"endpoint1-proddodeacompsvc-dode.streaming.media.usgovcloudapi.net",
"enterpriseregistration.windows.net",
"eus-www.sway-cdn.com",
"eus-www.sway-extensions.com",
"excelbingmap.firstpartyapps.oaspapps.com",
"firstpartyapps.oaspapps.com",
"g.live.com",
"gcc-high.activity.windows.us",
"gcch-mtis.cortana.ai",
"gcchigh.loki.office365.us",
"go.microsoft.com",
"gov.teams.microsoft.us",
"graph.microsoft.com",
"graph.microsoft.us",
"graph.microsoftazure.us",
"graph.windows.net",
"informationprotection.hosting.portal.azure.net",
"insertmedia.bing.office.net",
"login-us.microsoftonline.com",
"login.live.com",
"login.microsoft.com",
"login.microsoftonline-p.com",
"login.microsoftonline.com",
"login.microsoftonline.us",
"login.windows-ppe.net",
"login.windows.net",
"logincert.microsoftonline.com",
"loginex.microsoftonline.com",
"lpcres.delve.office.com",
"manage.office365.us",
"management.azure.com",
"mem.gfx.ms",
"mlccdn.blob.core.windows.net",
"mlccdnprod.azureedge.net",
"mscrl.microsoft.com",
"msdn.microsoft.com",
"msteamsstatics.blob.core.usgovcloudapi.net",
"myanalytics-gcc.microsoft.com",
"myanalytics.microsoft.com",
"nexus.microsoftonline-p.com",
"nps.onyx.azure.net",
"o15.officeredir.microsoft.com",
"ocos-office365-s2s.msedge.net",
"ocsa.officeapps.live.com",
"ocsp.msocsp.com",
"ocsredir.officeapps.live.com",
"ocws.officeapps.live.com",
"od.apps.mil",
"odc.officeapps.live.com",
"office.live.com",
"office15client.microsoft.com",
"officeapps.live.com",
"officecdn.microsoft.com",
"officeclient.microsoft.com",
"officehome.msocdn.us",
"officepreviewredir.microsoft.com",
"officeredir.microsoft.com",
"ols.officeapps.live.com",
"oneclient.sfx.ms",
"outlook-dod.office365.us",
"outlook.office.com",
"outlook.office365.com",
"outlook.office365.us",
"partnerservices.getmicrosoftkey.com",
"passwordreset.microsoftonline.com",
"peoplegraph.firstpartyapps.oaspapps.com",
"pf.events.data.microsoft.com",
"pf.pipe.aria.microsoft.com",
"policykeyservice.dc.ad.msft.net",
"portal.apps.mil",
"portal.office365.us",
"prod.do.dsp.mp.microsoft.com",
"prod.firstpartyapps.oaspapps.com.akadns.net",
"prod.msocdn.com",
"prod.msocdn.us",
"protection.office.com",
"provisioningapi.microsoftonline.com",
"r.office.microsoft.com",
"reports.apps.mil",
"scc.office365.us",
"secure.aadcdn.microsoftonline-p.com",
"security.apps.mil",
"security.microsoft.com",
"security.microsoft.us",
"shellprod.msocdn.com",
"signup.live.com",
"smtp.office365.com",
"ssw.live.com",
"staffhub.ms",
"static.sharepointonline.com",
"statics.teams.microsoft.com",
"storage.live.com",
"support.microsoft.com",
"sway.com",
"tasks.office365.us",
"tb.events.data.microsoft.com",
"tb.pipe.aria.microsoft.com",
"teams.microsoft.com",
"teamsapuiwebcontent.blob.core.usgovcloudapi.net",
"technet.microsoft.com",
"telemetryservice.firstpartyapps.oaspapps.com",
"tsfe.trafficshaping.dsp.mp.microsoft.com",
"update.microsoft.com",
"webmail.apps.mil",
"webshell.dodsuite.office365.us",
"wikipedia.firstpartyapps.oaspapps.com",
"windowsupdate.com",
"wus-firstpartyapps.oaspapps.com",
"wus-www.sway-cdn.com",
"wus-www.sway-extensions.com",
"www.microsoft.com",
"www.office365.us",
"www.ohome.apps.mil",
"www.onedrive.com",
"www.outlook.com",
"www.sway.com");
for (d in domain_pattern_list)
{
if (shExpMatch(host, domain_pattern_list[d]))
{
return 'DIRECT';
}
}

/* Don't proxy redirects to SSO gateway */
if (false)
{
return 'DIRECT';
}

/* Handle SSO redirector requests for roaming users */
if (false)
{
return 'DIRECT';
}

/* Query page should always resolve to the proxy - even if it's treated as a local address */
if (isResolvable(host) && !(shExpMatch(url, 'http://query.webdefence.global.blackspider.com/*')))
{
var hostIP = dnsResolve(host);

/* Don't proxy non-routable addresses (RFC 3330) */
if (isInNet(hostIP, '0.0.0.0', '255.0.0.0') ||
isInNet(hostIP, '10.0.0.0', '255.0.0.0') ||
isInNet(hostIP, '127.0.0.0', '255.0.0.0') ||
isInNet(hostIP, '169.254.0.0', '255.255.0.0') ||
isInNet(hostIP, '172.16.0.0', '255.240.0.0') ||
isInNet(hostIP, '192.0.2.0', '255.255.255.0') ||
isInNet(hostIP, '192.88.99.0', '255.255.255.0') ||
isInNet(hostIP, '192.168.0.0', '255.255.0.0') ||
isInNet(hostIP, '198.18.0.0', '255.254.0.0') ||
isInNet(hostIP, '224.0.0.0', '240.0.0.0') ||
isInNet(hostIP, '240.0.0.0', '240.0.0.0') ||
isInNet(hostIP, '100.64.0.0', '255.192.0.0'))
{
return 'DIRECT';
}

/* Don't proxy local addresses */
if (false)
{
return 'DIRECT';
}
}


if (hosted)
{
if (url.substring(0, 6) == 'https:' || url.substring(0, 4) == 'wss:')
{
var pats = new Array("*.zoom.us",
"eega.login.ap1.oraclecloud.com",
"*.google.com",
"zopim.com",
"*.trendmicro.com",
"detect.firefox.com",
"bb.org.bd",
"meetingconnector.ip",
"workspace.turns.goog",
"*.googleusercontent.com",
"*.youtube-nocookie.com",
"*.swift.com",
"tpa.gdassist.com",
"*.bb.org.bd",
"*.westernunion.com",
"zoom.crc",
"zoomgov.com",
"*.jpmorgan.com",
"biznovelty.xyz",
"tunnel11.zoom.us",
"*.ny.zoomcrc.com",
"*.microsoft.com",
"*.gdassist.com",
"*.zoomgov.com",
"*.office.com",
"*.office365.com",
"redirector.gv11.com",
"*.microsoftonline.com",
"meetingconnector2.ip",
"ny.zoomcrc.com",
"*.autodesk.com",
"*.gstatic.com",
"*.ytimg.com",
"support.nelito.com",
"bracelectra.fx.com",
"edge-chat.facebook.com",
"bracbank.taleo.net",
"*.googleapis.com",
"sanctionsscreening.browse.swiftnet.sipn.swift.com",
"*.live.com",
"*.whatsApp.net",
"vpn.bracbank.com",
"sj.zoomcrc.com",
"*.illusionblack.com",
"*.whatsapp.com",
"*.nelito.com",
"fiuportal.bb.org.bd",
"*.bracbank.com",
"screening-utility.swiftnet.sipn.swift.com",
"*.googlevideo.com",
"meetingconnector.ip2",
"*.redhat.com",
"*.crowdstrike.com",
"user.mobireach.com.bd",
"oraclecloud.com",
"zoom.us",
"*.sj.zoomcrc.com",
"idp.swiftnet.sipn.swift.com",
"swift.com",
"meetingconnector2.ip2");
for (i in pats)
{
if (shExpMatch(host, pats[i].toLowerCase()))
{
// non-SSL-terminate hosts must use the normal address/port
return 'PROXY ipv4.157.51.199.175.hybrid-web.proxyfqdn.com:8080';
}
}
}
if (url.substring(0, 5) == 'http:' || url.substring(0, 6) == 'https:' || url.substring(0, 4) == 'wss:')
{
return 'PROXY ipv4.157.51.199.175.hybrid-web.proxyfqdn.com:8080';
}
if (url.substring(0, 4) == 'ftp:')
{
// ftp must use the normal address/port
return 'PROXY ipv4.157.51.199.175.hybrid-web.proxyfqdn.com:8080';
}
}
else
{
if (url.substring(0, 5) == 'http:' || url.substring(0, 6) == 'https:' || url.substring(0, 4) == 'ftp:')
{
return proxy_addresses;
}
}
return 'DIRECT';
}