Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've searched high and low, and I only find a few mentions of this "bad proxy list" feature of internet explorer. Basically, if you have a PAC/wpad.dat file for auto proxy configuration, and your script returns multiple proxies (for failover), internet explorer will always use the first one if it is available. If it is not available, it is supposed to be added to a bad proxy list, not to be tried again for 30 minutes, and IE will start using the next proxy that was returned.

In my example I am using a squid proxy. If I stop the squid service on my proxy server, everything works as expected, IE quickly starts using the second proxy, and doesn't try the first proxy again for 30 minutes.

If I actually take down the Proxy server entirely (in this example, i am doing an "ifdown eth0" on my proxy), internet explorer keeps trying the proxy. It will eventually use the second proxy in the list, but the first one never seems to get added to the "bad proxy list", every new request takes about 60 seconds, so if you have a website that loads much external content, it can take a very long time to load.

Anybody else providing redundant proxies with a PAC file, and do you have this same problem if your primary proxy is totally unreachable?

share|improve this question
Check your ACL, maybe there is something wrong. – Asong Soekamti May 29 '14 at 12:58

This is caused by a bug of IE9. If you stop the proxy service it will return a RST packet and IE9 will add the proxy to the bad proxy list. If your proxy server is actually down and there will be a TCP timeout IE9 will not put your proxy to the bad proxy list.

In order to solve this bug, you have to install following hotfix:

The hotfix is also included in following Security Bulletin:

But be aware that you have to install the LDR branch of this Security Bulletin as the normal installation (GDR-branch) will not install hotfixes.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.