Send Only Target Sites Through Residential Proxies: PAC Files and Split-Routing Rules

Residential proxies are billed by the gigabyte, and a surprising share of what flows through them has nothing to do with the site you're collecting from. Browser and OS updates, unrelated tabs, third-party analytics, web fonts and autoplaying video all go out through the proxy if you let them, and every megabyte comes off your balance.

Split routing fixes that with one rule: target domains go through the paid proxy, everything else goes direct. This guide covers that single technique in depth: PAC files for browsers, per-domain proxy selection in scripts, and the situations where you should not split traffic at all.

Is it worth the effort?

Here's what residential bandwidth costs at three of our partners (from their pricing pages, checked on 2026-10-05; 711Proxy on 2026-10-06):

Say you use 50 GB a month and a third of it is noise. At $2/GB, that's around $33 a month spent on traffic you didn't need. The higher your volume or your per-GB rate, the faster split routing pays back the hour it takes to set up. For broader context on where residential bandwidth goes and how providers price it, see Best Rotating Residential Proxies and the cheapest proxies price comparison.

Method 1: a PAC file for the browser

A PAC (proxy auto-config) file is a small JavaScript file. Before each request, the browser calls FindProxyForURL and uses the return value to decide whether to go through a proxy or connect directly.

function FindProxyForURL(url, host) {
  // Target sites: send through the residential proxy
  var targets = ["example-shop.com", "example-data.org"];
  for (var i = 0; i < targets.length; i++) {
    if (host === targets[i] || dnsDomainIs(host, "." + targets[i])) {
      return "PROXY gate.your-provider.example:8000";
    }
  }
  // Everything else: direct
  return "DIRECT";
}

Things that trip people up:

• Return values. PROXY host:port means an HTTP proxy, SOCKS5 host:port means SOCKS5, and DIRECT means no proxy. If you're unsure which protocol your provider endpoint expects, see SOCKS5 vs HTTP Proxy.
• Authentication. You can't put a username and password in a PAC file. The browser will prompt for credentials, or you can use IP allowlisting in your provider's dashboard where it's offered. Check the dashboard for whether and how your provider supports it.
• Loading it. In Chrome, pass --proxy-pac-url= with the file's URL at launch. In Firefox, open network settings and choose "Automatic proxy configuration URL".
• Getting the domain list right. Sites rarely load from one hostname. Open the browser's developer tools, watch the Network tab while you use the site, and note every domain that belongs to the target: CDNs, API subdomains, image hosts. Missing one means those requests go direct.

Method 2: per-domain proxy choice in scripts

When you're writing a scraper, the biggest saving usually isn't split routing at all. It's not requesting what you don't need: fetch the page or API endpoint you're after, and skip images, video and fonts. Where a script does touch several sites, choose the proxy per host:

from urllib.parse import urlparse
import requests

PROXY = "http://user:[email protected]:8000"
TARGETS = {"example-shop.com", "example-data.org"}

def fetch(url):
    host = urlparse(url).hostname or ""
    use_proxy = any(host == t or host.endswith("." + t) for t in TARGETS)
    proxies = {"http": PROXY, "https": PROXY} if use_proxy else None
    return requests.get(url, proxies=proxies, timeout=30)

With a headless browser, request interception lets you block image, media and font resource types outright. On media-heavy sites that often saves more than routing rules do.

When not to split

Split routing means different parts of the same page can arrive from different IP addresses. For data collection that's usually fine. For logged-in accounts it works against you:

• If the target's CDN, login or payment subdomains go direct, the site sees both your proxy IP and your real IP in the same session.
• The point of an anti-detect browser profile is a single, consistent network identity per account. Tools like AdsPower bind a proxy to each profile. For store and social media profiles, keep the whole profile on its one proxy and don't layer split rules on top.

So split routing belongs with scraping, price monitoring and availability checks: jobs where nothing is logged in and session consistency doesn't matter.

Common mistakes

Matching too loosely. A rule like "anything containing shop" catches unrelated domains and sends them through paid bandwidth. Match the exact domain and its subdomains, as in the example above.

Forgetting DNS. With an HTTP proxy, the proxy resolves the target hostname. With SOCKS5, whether DNS goes through the proxy depends on the client and settings. If DNS for target domains resolves locally, the site's DNS provider sees your own network. The SOCKS5 vs HTTP guide explains the difference.

Leaving the PAC file stale. A PAC file is code. Keep it in version control with a comment for each domain explaining why it's there, so whoever maintains it next can prune it safely.

Splitting where consistency matters. That's the subject of the next section.

Checking that it works

1. Open an IP lookup page that lives on a target domain (if one exists) and a general IP lookup page. The first should show the proxy IP, the second your own.
2. Compare a day of traffic in the provider dashboard against a day before the change.
3. Revisit the domain list now and then. Site redesigns add subdomains, and anything you miss quietly goes direct.

Compliance

Split routing is a cost-saving technique, nothing more. Collect only public data, follow each site's terms and robots rules, and keep request rates reasonable.

For more residential options, see the residential proxies type page and the web scraping use case.