Honest limitation: this runs your PAC file’s real
FindProxyForURL() logic client-side in a sandboxed iframe — dnsDomainIs, shExpMatch, isPlainHostName, and similar string-based functions work exactly as they would in a real browser. Functions that require actual DNS resolution (isInNet, dnsResolve) only work correctly when your test URL’s host is already a literal IP address — a browser tab can’t perform arbitrary DNS lookups the way a real proxy client does. If your PAC file’s routing decision depends on resolving a hostname to an IP first, test with the IP directly to get an accurate result.
Debugging a PAC file that’s routing traffic wrong in production — not just testing one URL at a time? That’s exactly the kind of thing a Zscaler/SASE deployment review catches before it causes an outage.