Shadowrocket Rules for Selected Websites: DOMAIN-SUFFIX and FINAL

1. Understand Global Routing and rule policies

Selecting a connection in Home does not automatically make only certain websites use the proxy. The connection selected in Home determines the proxy exit, while Global Routing determines how requests are routed. To use rules, set Global Routing to Config, then make sure the intended configuration is selected in Config. Editing a file that is not active will not change how the current connection handles traffic.

Proxy applies the proxy globally; Direct sends all traffic directly. Config evaluates rules in the active configuration. Scene is for scene-based setups and is not required for these rules. During troubleshooting, keep Config selected so a scene change does not affect the results you are checking.

2. The minimal setup: DOMAIN-SUFFIX followed by FINAL

This snippet sends example.com and its subdomains through PROXY, and all other requests through DIRECT. It is the rules section of a configuration, not a complete configuration file with server parameters. If the editor already shows a separate rule list, add the two rules there; do not add the section heading as a rule.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Do not include https://, a path, query parameters, or a port in the domain field. For example, even if a page URL contains /watch?id=1, the rule should contain only the domain. DOMAIN-SUFFIX does not require *.example.com; it matches on domain boundaries and will not match another domain just because it contains the same letters.

To proxy only one exact hostname, without covering the entire domain and all its subdomains, use DOMAIN,video.example.com,PROXY. Its scope differs from DOMAIN-SUFFIX, making it useful when you want to route a website's main host separately from other subdomain services.

3. DOMAIN-KEYWORD and rule order

Rules are evaluated in order. Once a request matches a rule and a policy is determined, later rules will not override it. Put specific exceptions first, broader rules after them, and FINAL last. In the example below, one subdomain goes DIRECT while other example.com requests use the proxy.

[Rule]
DOMAIN,files.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

If you move DOMAIN-SUFFIX to the first line, files.example.com will match it before the DOMAIN direct exception gets a chance to apply. Likewise, do not put FINAL above the target domain rules, or those later rules will have no effect on the requests it matches.

• Prefer DOMAIN: Use it for one exact hostname when you want the narrowest possible match.
• Use DOMAIN-SUFFIX in most cases: It matches a domain and its subdomains, making it suitable for proxying selected websites as described here.
• Use DOMAIN-KEYWORD with care: DOMAIN-KEYWORD,example,PROXY matches the string anywhere in a domain, so it may also match myexample.net.
• Keep one clear fallback: If the existing configuration already has a FINAL rule, adjust that fallback instead of adding another FINAL after it.

GEOIP and IP-CIDR are address-based rules and cannot replace a domain list. For example, IP-CIDR,192.0.2.0/24,DIRECT,no-resolve matches an address range; the example range is for documentation only. no-resolve means this IP rule will not trigger an additional domain lookup. If the existing configuration uses GEOIP or a broad IP-CIDR range earlier in the list to select a policy, check its position so it does not handle requests that should reach later rules.

4. Save and enable the rules in Config

Keep a copy of your current working configuration first. A subscription updates existing connection details; Config determines traffic routing. These serve different purposes. You do not need to change your subscription or edit server settings for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard.

1. Check the connection

   In Home, make sure you have imported your own connection and selected a working exit. If the connection itself is unavailable, resolve that first, then test the rules.

2. Back up the configuration

   Go to Config, find the configuration in use, and save a copy or export the original file. Do not overwrite your only working configuration.

3. Edit the rules

   Open the configuration editor and find the rules section. In a text editor, locate [Rule], put the target DOMAIN-SUFFIX rule before FINAL, and set the fallback to FINAL,DIRECT.

4. Enable the configuration

   Save your changes, return to Config, and confirm that the edited configuration is selected. Then go to Home → Global Routing and choose Config.

5. Start fresh requests

   Reconnect, then close and reopen the test page. Existing long-lived connections may continue using their original outbound route, so a single refresh is not enough to determine whether a rule is working.

Remote configuration updates may overwrite local changes. If the configuration is updated periodically, keep a record of your edits and check that the target rules and FINAL are still present after an update. Updating a connection subscription in Home does not necessarily update or enable the rules file in Config.

5. Verify using request logs, not just the website's exit IP

Rules apply to requests, not to an entire browser tab. A website may load content from separate domains for its main page, static assets, sign-in, and media. If the page text loads but images do not after proxying only the main domain, check the domain used by the failed resources first instead of sending all requests through Proxy.

• Prepare two test cases: Choose one domain covered by the rule and another clearly outside its scope, then send a new request to each.
• Check the request log: Verify the actual hostname, matching rule, and final policy. The target request should use PROXY; the comparison request should use the DIRECT policy specified by FINAL.
• Separate the issues: If a request matches PROXY but the page still fails, routing and connectivity are separate problems. Check the proxy connection instead of repeatedly adding the same domain rule.
• Add required domains: If a required resource is going DIRECT, add only domains confirmed to be part of that page's requests, then test again.

Testing a page that reports your outbound IP shows only how that page's own request was routed; it does not prove that every website uses the same policy. Browser cache, connection reuse, and the app's DNS behavior can also affect what you see. If the log shows only an IP instead of the expected domain, check whether the request uses an IP directly, whether the app uses its own resolver, and whether the current DNS settings affect domain identification. Do not immediately broaden the rule to cover an entire address range.

6. Troubleshoot connection errors separately from rule errors

The following are common network error messages, not fixed prompts shown by the rule editor. When an error appears, first check whether the request matched PROXY or DIRECT, then troubleshoot that route. Do not change domain rules, DNS, and the server port all at once after a single timeout; otherwise, it is hard to tell which change made a difference.

If there are no network errors but every request shows PROXY, check whether Global Routing is still set to Proxy and whether a broad rule appears earlier in the list. If every request shows DIRECT, check whether Direct is selected, whether the correct Config is enabled, and whether the actual request domain matches the value in the rule.

7. Common questions about proxying selected websites

Check four things: Config is enabled, the target domain is correct, rules are ordered from specific to broad, and FINAL points to DIRECT. Get the minimal rules working first, then add required website domains one at a time. This is usually easier to maintain than importing a large set of rules with unclear purposes.