Shadowrocket: Route Only Selected Websites with DOMAIN-SUFFIX Rules

1. Understand rules, policies, and routing modes

Routing only selected websites requires two things: rules for the target sites must point to PROXY, while other requests go to DIRECT. A subscription provides server details; Config determines how requests are routed. Switching servers or updating a subscription alone does not create this routing setup. Before you begin, make sure a usable server is available under Home and back up the active configuration.

This guide uses the built-in PROXY and DIRECT policies. PROXY sends requests to the current proxy selection; DIRECT connects to the destination directly. If your existing configuration uses a custom policy group, you can use its exact name at the end of a rule, but first confirm the group is defined and has an available member. For a first edit, start with the minimal structure below to avoid changing policy groups and match conditions at the same time.

Proxy and Direct under Home → Global Routing select proxying or direct connections globally; they cannot verify the per-rule routing described here. For this setup, use Config to apply the rules in the configuration. Scene switches between scenarios; keep it set to Config during initial testing to avoid introducing other variables. Settings → On Demand controls when connections are established on demand; it is not where domain rules are edited.

2. Choosing DOMAIN-SUFFIX or DOMAIN-KEYWORD

Domain rules match the hostname in a request, not the full web address. For https://www.example.com/account, enter example.com or www.example.com. Do not include https://, the /account path, query parameters, or a port in the domain field. Separate rule fields with standard commas, and keep rule keywords in English.

DOMAIN-SUFFIX matches at a domain boundary: a rule for example.com can match img.example.com, but not notexample.com just because the strings look similar. DOMAIN-KEYWORD has no such boundary, so the keyword example can also match other hostnames containing that string. When you know the target domain, prefer DOMAIN or DOMAIN-SUFFIX over guessing with a short keyword.

3. Minimal rule snippet and top-to-bottom order

The snippet below sends example.com, example.net, and their subdomains through the proxy, while connecting other requests directly. [Rule] marks the rules section in a configuration file. Include it once when editing the file as text. If you add rules through the rule list, enter each rule type, domain, and policy separately; do not enter the section marker as a rule.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
FINAL,DIRECT

Rules are generally matched from top to bottom, and the first matching rule determines the policy for that request. If FINAL appears near the top, later target rules cannot take effect. Likewise, if an existing DIRECT rule or broad rule set already covers a target domain, place the new PROXY rule above it. Changing only the final rule may not produce any visible difference.

To keep a subdomain direct, place the more specific exception above the broader rule. In the snippet below, status.example.com uses DIRECT, while www.example.com and other subdomains use PROXY. An exception placed after DOMAIN-SUFFIX will not override a result that has already matched.

[Rule]
DOMAIN,status.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

• DOMAIN-KEYWORD: If needed, you can add DOMAIN-KEYWORD,example,PROXY, but this broadens the match scope and is not required.
• GEOIP: GEOIP,CN,DIRECT matches based on geographic data for the destination IP. It does not mean “all Chinese-language websites” and cannot replace a list of target domains.
• IP-CIDR: Matches a destination IPv4 range and is useful when you know the exact address range. If a website uses shared addresses or a CDN, adding an IP rule may also affect other domains.
• FINAL: Keep one effective final fallback. This guide sends other traffic directly, so use FINAL,DIRECT at the end, not FINAL,PROXY.

An existing configuration may also include DNS, Host, policy groups, and other sections. The code above shows only the Rule section; it does not mean you should delete and rebuild the entire configuration. Before editing, make a copy of the existing configuration and check whether [Rule] is already present. Do not append a duplicate section to the end of the original file.

4. Save in Config and switch to rule-based routing

The steps below follow the Home, Config, and Settings interface. Edit the configuration that is actually enabled, not a remote copy with the same name. Updating a remote configuration may overwrite local changes. For rules you want to keep, save them in a separate local copy and confirm which configuration is selected each time you switch.

1. Back up the configuration

   Open Config, find the configuration currently in use, and make a copy first. Note its name so you can switch back if testing fails. Do not overwrite your only copy.

2. Edit the rules

   In Config, open the editing controls for the local configuration and go to Rule. Add a DOMAIN-SUFFIX rule in the rule list, replacing example.com with the actual target domain and selecting PROXY as the policy. Alternatively, edit the existing [Rule] section in a text editor.

3. Check the order

   Place PROXY rules for the target websites above any broad rules that could conflict, and confirm that FINAL,DIRECT is the last rule. Save your changes, then select this configuration in the Config list to make it active.

4. Select the mode

   Go back to Home → Global Routing → Config and confirm that the current proxy selection is valid. If the mode is set to Proxy or Direct, the browsing results cannot tell you whether the domain rules you just edited are working.

5. Test again

   Turn on the connection and reopen the target website. Connections established before the change may continue to use their previous route. If needed, close the page, reconnect, and test both a target domain and one that is not on your list.

Subscription updates refresh the server list and parameters; editing Config changes how requests are routed. These are separate tasks. If you only need to add a website to the proxy list, you usually do not need to import the subscription again or change the server's port, password, SNI, or TLS settings. For initial import and connection steps, see the quick start guide. For mode differences, see proxy modes explained.

5. Verify with connection logs, not just by opening a page

A page loading successfully does not prove it used the proxy; some websites are also accessible over a direct connection. A page failing to load does not prove the rule failed to match either—server connectivity, DNS resolution, or the website itself could be the cause. Check the connection log for the target hostname, matched rule, and resulting policy. The log interface may vary by platform, but the details to verify are the same.

The table shows the expected results for the rules above; it does not report connectivity tests for the example sites. In your own tests, use the domains you need and change one condition at a time. If the log shows that a target matched PROXY but the connection still fails, check the current server and the parameters provided by your service provider instead of broadening DOMAIN-KEYWORD repeatedly.

A web page may load images, login pages, CAPTCHA, and API requests from separate domains. Matching the main page to PROXY does not automatically route those requests the same way. If text appears but images do not, or the home page loads while login keeps spinning, repeat the action and find the hostname for the failed request. Add only the domains you actually need to the list.

• First confirm that the request timestamp in the log is after the rule change so you are not looking at an old connection.
• Check the domain of the resource that actually failed, not just the main domain in the address bar.
• If the target falls through to FINAL, check the spelling, active configuration, and rule order before adding any dependent domains.
• If the log shows only an IP address and no domain, check DNS and hostname detection. Do not add an entire shared CDN range to the proxy list.

6. Timeouts, DNS failures, and common issues

When troubleshooting, first distinguish between “not routed by the rule” and “routed by the rule, but the connection failed.” The following are browser error codes, not fixed Shadowrocket messages; how they appear may vary between browsers. Use the connection log to investigate rather than assuming a server or rule problem based on one error code alone.

Use this repeatable checklist: the correct Config is active, Global Routing is set to Config, target-domain rules come first, FINAL,DIRECT comes last, and the current server is working. Then check the log with a new connection. For more rule types, see the configuration field reference. Avoid adding a whole IP range just because one website is displaying incorrectly.