Shadowrocket DOMAIN-SUFFIX Rules: Proxy Only Specific Websites

1. Make sure Global Routing is set to Config

The connection toggle and routing mode are separate settings: turning on the connection sends traffic through the system VPN tunnel, but does not mean every connection uses a proxy. To keep traffic direct by default and proxy selected websites, go to Home → Global Routing, choose Config, and make sure the configuration you intend to edit is enabled.

This guide assumes you already have a working proxy service. PROXY in a rule specifies a policy; it is not a server address and does not create a working service. First, select an available server in Home and check whether the current configuration contains policy groups that could affect your selection.

Settings → On Demand manages when to connect; it does not determine whether a particular website uses DIRECT or PROXY. When troubleshooting, check tunnel connectivity separately from which rule a connection matches. Don’t keep toggling On Demand to fix domain rules.

2. Rules match from top to bottom; put FINAL last

In the basic rule setup covered here, a connection uses the policy specified by the first matching rule; later rules do not override it. Put specific exceptions before broader rules, and place FINAL last to handle all remaining connections.

• DOMAIN,api.example.com,DIRECT: Matches only this exact domain. Use it to keep one domain direct when the rest of the site uses a proxy.
• DOMAIN-SUFFIX,example.com,PROXY: Matches example.com and its subdomains, such as www.example.com, but not notexample.com.
• DOMAIN-KEYWORD,example-media,PROXY: Matches connections whose domain contains this string. Its scope is broader than a domain suffix, so use it with care.
• IP-CIDR,203.0.113.0/24,PROXY,no-resolve: Matches the destination IPv4 range. no-resolve means the rule will not actively resolve a domain just to check for a match.
• FINAL,DIRECT: Uses DIRECT when none of the preceding rules match. No domain or IP range is needed.

DOMAIN-SUFFIX matches a domain, not a full URL. Enter example.com, not https://example.com/video. This rule cannot distinguish between paths on the same domain; /video, query parameters, and page titles are not match criteria.

3. Editable Config example

The example below shows only the [Rule] section, not a complete service configuration. The domains and IP range illustrate the syntax; 203.0.113.0/24 is reserved for documentation and should not be used to test a real service. Replace these examples with the actual domains or verified IP ranges you want to route, and remove any lines you don’t need.

[Rule]
DOMAIN,api.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
DOMAIN-KEYWORD,example-media,PROXY
IP-CIDR,203.0.113.0/24,PROXY,no-resolve
FINAL,DIRECT

The first rule keeps api.example.com as a direct exception. The next two suffix rules route the specified domains and their subdomains through PROXY. The keyword rule illustrates the syntax; if you know the full domain, DOMAIN or DOMAIN-SUFFIX is usually a better choice and helps avoid unintended matches. The final IP rule covers a known range, while FINAL keeps all other connections direct by default.

1. Back up your configuration

   Open Config and select the active configuration. Save a copy of the original file or export a backup first. Save remote configurations as editable local copies to prevent future updates from overwriting your changes.

2. Edit the rules

   In Config, open the editing controls for the local file and find its existing [Rule] section. Merge your rules into that section rather than adding a second [Rule] section, and check where the existing FINAL rule appears.

3. Check the policies

   Check that DIRECT and PROXY are spelled correctly. If you keep custom policy group names from the original file, make sure those groups still exist. This example uses the generic PROXY policy; you don’t need to create a server with that name.

4. Enable the configuration

   After saving, select the edited file in Config, then go to Home → Global Routing and choose Config. Saving the file without enabling it does not change the rules used by current connections.

5. Reconnect

   Turn off the connection toggle in Home, then turn it back on and make a new web request. Existing long-lived connections may continue using the previous route; close the relevant page or app before testing again.

If the original configuration also includes GEOIP,CN,DIRECT, it selects DIRECT based on the destination IP’s geographic data; it does not check a website’s language or domain suffix. This rule is usually unnecessary when traffic is direct by default. If you keep it, place it after specific site proxy rules and before FINAL to prevent it from matching too early.

4. Verify with connection details, not just by opening a webpage

A webpage loading only confirms that the request received a response; it does not show which policy was used. Check the connection details for the destination domain, destination IP, matched rule, and policy. The location and fields may vary by interface; focus on the actual result for the same newly created connection.

The table shows expected results based on the rules, not connectivity tests for the example domains. For real-world testing, use sites you have added to your configuration. Change one rule at a time, then create a new connection and record the result. This helps identify whether the issue is rule order, an inactive configuration, or an unreachable service.

• Homepage loads, but images don’t: Check whether images, sign-in, and API requests use other domains. Add only domains confirmed in the connection details as needing a proxy; there’s no need to broaden the rule to a catch-all keyword.
• Only the destination IP is shown: The app may be connecting directly to an IP, or the connection may not be associated with domain information. A domain rule cannot match this kind of connection based on the website name alone.
• IP rule doesn’t match: Check whether the connection is using IPv6. An IPv4 IP-CIDR rule won’t match IPv6; assess a separate IP-CIDR6 rule if needed.
• Different port: Standard HTTPS connections commonly use destination port 443, but the domain rules in this guide don’t specify a port. Don’t append :443 to a DOMAIN-SUFFIX domain.

5. Troubleshoot timeouts and resolution errors separately

Even when a rule selects PROXY, a connection can still fail because of DNS, the server connection, or the destination service. The system network error identifiers below are common examples; troubleshoot them only if they appear in your logs. They are not exclusive indicators of incorrect rules, and an error code alone cannot identify which end is at fault.

A domain rule specifies which policy to use when a domain is identified; it does not guarantee that all DNS queries use the same proxy. The DNS source, resolution path, and outgoing connection are related but separate settings. For an IP-CIDR rule with no-resolve, don’t assume every domain request will be resolved first and then checked against that range.

6. Common questions about routing selected websites