Shadowrocket Split Tunneling Rules: Route Selected Websites Through a Proxy with DOMAIN-SUFFIX

Set Global Routing to Config first

“Route only selected websites through a proxy” involves two separate conditions: matching domains use PROXY, while all other requests default to DIRECT. Adding domain rules alone isn’t enough. If Global Routing is set to Proxy, requests are handled using global proxy routing, so you can’t use that mode to verify how this domain list routes traffic.

Open Global Routing on Home and select Config. Then, in Config, confirm which configuration file is active. The proxy connection selected on Home must also be working. This guide assumes you already have your own provider and subscription or connection details; it does not cover obtaining a connection service.

On Demand establishes or restores connections based on conditions; it does not replace domain rules. If the connection changes automatically during testing, review the existing conditions under Settings → On Demand. Note the original settings, then temporarily manage the connection manually. Avoid changing On Demand, DNS, and rules at the same time, or it will be difficult to tell which change made a difference.

Minimal rules: DOMAIN-SUFFIX with FINAL,DIRECT

The following is a rules snippet, not a complete configuration with all connection parameters. example.com is a sample domain, not a recommendation for which websites to proxy. Replace it with the domain you want to route, then merge the rules into the [Rule] section of your existing configuration. Do not use this snippet to overwrite the entire file.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX,example.com,PROXY matches example.com itself and subdomains such as www.example.com and api.example.com. It matches by domain boundaries, so notexample.com won’t match just because it ends with the same letters.

FINAL,DIRECT sends requests DIRECT when none of the preceding rules match. Rules are checked in order, and the first match determines the policy. A broader rule above your list—or a FINAL rule that appears too early—may intercept a request before it reaches the rule you added.

DOMAIN vs. DOMAIN-SUFFIX vs. DOMAIN-KEYWORD

How precisely your list matches depends on the rule keyword. Use DOMAIN-SUFFIX when both a website’s base domain and its subdomains should use the proxy. Use DOMAIN for a single hostname. DOMAIN-KEYWORD matches a string anywhere in the domain, so it has a broader scope and should not be treated as a drop-in replacement for a domain suffix.

Do not include https://, a port, path, or query parameters in a domain rule. For example, enter example.com, not https://example.com/account. Domain-based routing cannot distinguish between HTTPS page paths on the same host.

To route one subdomain DIRECT while sending other requests under the same parent domain through the proxy, put the more specific exception before the suffix rule. In the example below, status.example.com goes DIRECT, while other matching domains use the proxy.

[Rule]
DOMAIN,status.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Save and enable your changes, one rule set at a time

Keep a copy of the original configuration before making minimal changes to your local file. A remote configuration update may overwrite local edits. Updating a connection subscription on Home is also different from updating a configuration file in Config. When troubleshooting, note the active connection and active configuration separately so you don’t mistake a change to the connection list for a loaded rule change.

1. Back up the configuration

   Open Config, confirm which configuration is active, and keep a copy. Note the existing FINAL policy and any referenced rule sets so you can restore them if needed.

2. Edit the rules

   In Config, open the local configuration you want to use and edit it. Add your domain list to the [Rule] section. Keep only one active final fallback rule in that section, with FINAL,DIRECT after your list.

3. Save and select

   After saving, return to Config and make sure the file you just edited is selected—not another configuration with a similar name. If you see a parsing error, check the English commas, keyword spelling, and number of fields on each line.

4. Set the routing mode

   Go to Home → Global Routing → Config and make sure a working proxy connection is selected. If needed, disconnect and reconnect so the test uses the current settings.

5. Test again

   Close the target webpage and open it again to trigger a new connection. Then check the data log for the domain, matching rule, and actual policy. Don’t rely only on long-lived connections established before the change.

When copying rules from another configuration, check that the referenced policy names exist. Custom group names aren’t built-in keywords, and a policy group defined in one file may not exist in another. If you’re implementing the allowlist pattern in this guide, first verify it with PROXY and DIRECT, then consider adding policy groups.

Verify routing by checking the matched rule, not just whether a page loads

A page loading successfully only shows that some connection path worked; it doesn’t prove the proxy was used. In Shadowrocket’s data log, check the domain, rule, and outbound policy for the request you just made. If logging isn’t enabled, review the data logging settings in Settings, then make another request. Keep only the records you need, and remove sensitive information other than domains before sharing them.

• On the list: Replace the example with your target domain, then visit the main site and one subdomain. Expect a DOMAIN-SUFFIX match with the PROXY policy.
• Not on the list: Visit a domain you know can connect directly and that isn’t in your list. Expect it to match FINAL and use DIRECT.
• Exception: If you added the specific domain exception shown earlier, visit that hostname by itself. It should match DOMAIN before reaching the suffix rule below it.

A webpage may connect to several domains for the main site, login, static assets, and media. The main site matching PROXY while image requests match DIRECT isn’t necessarily a problem. If text loads but images or login fail, identify the actual domain used by the failed request before adding it to the list. Don’t broaden the match by adding an overly short DOMAIN-KEYWORD.

GEOIP matches based on the destination IP’s geographic information, while IP-CIDR matches an IP range; neither identifies which website a domain belongs to. A website may use multiple addresses, and an address may be shared by several websites. For a strict allowlist, don’t add broad IP proxy rules for convenience, or requests outside the list may also use the proxy. Requests made directly to an IP address also aren’t guaranteed to match domain rules.

Connection failures: distinguish rule issues from outbound issues

If the log shows a PROXY match but the request still fails, changing DOMAIN-SUFFIX rules usually won’t help. The examples below are low-level error snippets that may appear during connection diagnostics. The exact text depends on the protocol and point of failure; you may not see the same complete message every time.

If the log shows DIRECT when you expected PROXY, check the rules: Is the correct file active? Is Global Routing set to Config? Did the request use a different domain? Is there an earlier matching rule above your list? Using this evidence to make targeted corrections is more effective than repeatedly rewriting the entire configuration.

FAQ: adding domains, updating rules, and restoring settings

Check just three things when you’re done: Config is active, requests for listed domains match the expected rule, and other requests use DIRECT. For more on configuration structure, see the site’s technical reference. To compare routing modes, see proxy mode guide.