In the GOPROXY list, a comma tells Go to try the next source only after a 404 Not Found or 410 Gone. A pipe tells it to try the next source after any error, including timeouts. The default is https://proxy.golang.org,direct, so by default a failing public proxy does not trigger a direct fetch.
The default
The Go modules reference gives the default value as:
https://proxy.golang.org,direct
The keyword direct means download from the version control repository where the module is developed. The keyword off means no network access is attempted.
How the separators behave
From the reference: list elements may be separated by commas or pipes, which determine error fallback behavior. When a URL is followed by a comma, the go command falls back to later sources only after a 404 or 410. When a URL is followed by a pipe, it falls back after any error, including non-HTTP errors such as timeouts.
An example of each:
GOPROXY=https://corp.example.com,https://proxy.golang.org
GOPROXY=https://corp.example.com|https://proxy.golang.org
With the comma, a company proxy that is down returns an error and the build stops. With the pipe, the build quietly continues to the public proxy.
Which one to choose
The comma is stricter and often what you want. It means "my internal proxy is the source of truth, and only a clean not found sends you elsewhere." A failure is loud, so you notice an outage and nobody gets a surprise download from somewhere you did not intend.
The pipe favors availability. It suits a mirror that is a convenience, not a control. The cost is that an outage or a misconfiguration changes where code comes from without any message.
| Need | Separator |
|---|---|
| Internal proxy is a policy control | Comma |
| Internal proxy is only a cache | Pipe |
| Never reach the internet | Single entry, or off |
Pair it with private module settings
If some modules must never go to a public proxy, mark them private. GOPRIVATE and related variables are covered in what GOPRIVATE, GONOPROXY and GONOSUMDB each do.
Test your setup
Run a build with the network path to your proxy blocked and see what happens. Then block only the public proxy. You want the results to match your intent, and it is easier to learn that on a Tuesday afternoon than during an incident.
Safeguard dependency and SBOM scanning can list the modules a build resolves and flag known vulnerabilities. You can try a free scan at gold.safeguard.sh/scan.
Quick check
What is the default GOPROXY?
https://proxy.golang.org,direct, according to the Go modules reference.
Does a timeout on the first proxy trigger fallback with a comma?
No. Only a 404 or 410 does. Use a pipe if you want fallback after any error.
Sources
Last reviewed: 19 October 2026.
