Shadowrocket: Route Only Selected Websites Through a Proxy with DOMAIN-SUFFIX and FINAL Rules

Quick overview

This guide is for users who have already established a basic connection in Shadowrocket and want to narrow the proxy scope. Set Global Routing to Config, add domain conditions for selected websites at the top of the rules, and use FINAL,DIRECT for all unmatched traffic. Then verify the result with temporary rules, request behavior, and rule order.

First, understand how Config handles a request

Shadowrocket applies Config rules in order only when Global Routing is set to Config. With Proxy selected, all traffic is handed to the proxy policy; with Direct, traffic connects directly; Scene selects a mode based on its conditions. To proxy only selected websites, first check Global Routing in Home and select Config.

The rule engine evaluates entries from top to bottom and stops at the first match. Once a request matches the first applicable rule, later DOMAIN-SUFFIX, GEOIP, or FINAL entries are not evaluated. Put narrow exception rules before broader rules, and keep the fallback rule at the end.

App sends a requestEnters the system tunnelReads destination detailsMatches rules in orderSelects an outbound policy

1 time

Stop after the first match

4 modes

Global Routing：Config / Proxy / Direct / Scene

2 layers

Domain rules and destination IP rules

80 / 443

Common HTTP and HTTPS ports

Rule matching uses more than the domain

Domain information: Used by DOMAIN, DOMAIN-SUFFIX, and DOMAIN-KEYWORD. These rules match hostnames, not URL paths, query parameters, or page titles.
Destination IP: Used by IP-CIDR and GEOIP. After the domain is resolved, the destination address may also be evaluated by IP-layer rules.
Destination port: DOMAIN-SUFFIX focuses on the domain itself. Whether a website uses the usual 80 or 443 port or another port, the domain rule can still match as long as the hostname qualifies.
Final fallback: FINAL handles traffic not caught by any earlier rule, so it must appear at the end of the rule list.

DOMAIN-SUFFIX, DOMAIN-KEYWORD, GEOIP, and FINAL compared

These four rule types cover different scopes. To proxy only selected websites, DOMAIN or DOMAIN-SUFFIX is usually the best choice. Use DOMAIN-KEYWORD only when the domain structure is unstable but contains a clearly distinctive fixed string. GEOIP classifies the destination IP using a geographic database, while FINAL checks neither the domain nor the address and handles all remaining requests.

The last field in a rule is the policy. PROXY sends the request to the proxy policy, DIRECT connects directly, and REJECT denies the request. If Config uses custom policy-group names, the final field must exactly match a name that exists in Config. A policy-name mismatch can prevent the expected outbound result even when the rule matches.

Rule keyword	Match target	Best for	Notes
DOMAIN	Exact hostname	Handling one specific hostname	Does not automatically include subdomains
DOMAIN-SUFFIX	Domain suffix	Covering the root domain and its subdomains	Avoid making the scope too broad
DOMAIN-KEYWORD	String within a domain	Matching multiple domains containing a fixed keyword	May match unrelated domains by mistake
GEOIP	Resolved destination IP	Classifying by the address's geographic region	Results depend on the IP and local database
IP-CIDR	IPv4 address range	Handling a fixed address block	Update the rule when the addresses change
FINAL	All remaining requests	Defining the default outbound path	Must be placed at the end of the rules

Broad and narrow rules for the same domain

[Rule]
DOMAIN,static.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

In the example above, static.example.com is sent to DIRECT first, while example.com and its other subdomains use PROXY. If the second line comes first, the static hostname matches DOMAIN-SUFFIX before the DOMAIN exception can run.

Conclusion: write exceptions first, scope rules next, and the fallback last

When checking rule order, organize entries as “exact hostname → domain suffix → broad keyword → IP classification → FINAL.” If another order is necessary, make sure every narrow condition appears before a broader condition that could cover it.

An editable Config for “proxy selected websites, connect directly to everything else”

The examples below use reserved example domains and do not represent real services. Before editing, copy the current Config as a backup. Then open Config, select the local configuration in use, and edit its Rule section. If the configuration comes from your own subscription, a later update may overwrite manual changes. A separate local Config with a clear record of custom rules is safer.

PROXY in the example must correspond to a proxy policy available in the current Config. Rules only decide which policy receives a request; they do not change the protocol used by the existing configuration. Whether the connection uses Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard, DOMAIN-SUFFIX follows the same first-match logic.

[Rule]
DOMAIN,login.example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
DOMAIN-KEYWORD,media-example,PROXY
GEOIP,CN,DIRECT
FINAL,DIRECT

Replace the full hostname: Change login.example.com to the hostname that needs separate handling. DOMAIN requires the complete hostname; do not add https://, a port, a slash, or a page path.
Replace the domain suffix: Change example.net to the target website's root domain. DOMAIN-SUFFIX covers both that domain and its subdomains.
Keep keywords only when justified: Use DOMAIN-KEYWORD only after confirming that multiple target domains share a unique string. If you do not need it, remove the line.
Confirm the default path: FINAL,DIRECT is the key to connecting all other traffic directly. If you mistakenly use FINAL,PROXY, unmatched requests will also enter the proxy policy.
Save and apply: Return to Config and confirm that the edited configuration is selected. Then go to Home, switch Global Routing to Config, and re-establish the connection.

When a fixed IP exception is needed

[Rule]
IP-CIDR,192.0.2.0/24,DIRECT,no-resolve
DOMAIN-SUFFIX,example.net,PROXY
FINAL,DIRECT

192.0.2.0/24 is a documentation-only example range. no-resolve means the IP rule will not trigger an extra domain lookup for matching, which is suitable when the destination already appears as an IP address. Do not permanently hard-code a website's address range based on one lookup, because distributed services may return different addresses by region, time, and network conditions.

How to verify that the rule affects only selected websites

A successful save does not mean the rule is working as intended. Check these separately: whether Config is enabled, whether the target domain is complete, whether an earlier rule captured the request, and whether the website calls other domains. Change one variable at a time so you can identify which rule caused the result.

Confirm the mode: In Home, check Global Routing and make sure it is set to Config rather than Proxy, Direct, or another mode temporarily selected by Scene.
Confirm the configuration: Open Config and check that the local configuration containing the new rule is selected. Editing an inactive copy will not change current traffic.
Test an ordinary website first: Open a site not covered by your rules. Because the last line is FINAL,DIRECT, it should continue using the direct connection path.
Test the target website next: Open the site covered by DOMAIN-SUFFIX. If the homepage loads but images, sign-in, or video fails, the page is usually calling additional domains.
Add dependent domains: Based on the request hostnames observable in Shadowrocket, add only the necessary DOMAIN or DOMAIN-SUFFIX entries one by one. Do not broaden the rule into an ambiguous keyword.
Retest exceptions: Test the target website, an ordinary website, and common system network functions. Confirm that the new rule is not below FINAL and does not cover unrelated domains.

Use temporary REJECT to determine whether a domain matches

When you cannot tell whether a domain actually participates in page loading, briefly change that domain's policy to REJECT. If the corresponding resource stops loading immediately, the domain and rule position are effective. Restore PROXY or DIRECT as soon as testing ends. This method is for troubleshooting, not long-term configuration.

[Rule]
DOMAIN-SUFFIX,assets.example.net,REJECT
FINAL,DIRECT

Error: Failed to load config

Cause and fix: Common causes include a missing comma in a Rule line, an incomplete section heading, or an empty policy field. Return to Config and check that each line follows the “rule keyword, match value, policy” structure. Confirm that [Rule] occupies its own line, then reload the configuration.

Error: Policy not found

Cause and fix: The policy named at the end of the rule does not exist in the current Config, or its capitalization differs from the actual name. Check the existing policy names and replace the entry character for character. Do not reuse a custom name from another configuration.

Common mismatches and ways to narrow the scope further

A website usually uses more than one domain. The main page, static assets, sign-in API, and media may each use different hostnames. If you write only the root domain and see “the page frame loads but content is missing,” Shadowrocket has not necessarily ignored the rule; other requests required by the page are simply not covered.

DOMAIN-KEYWORD is convenient, but its scope is difficult to judge accurately from the text alone. If a keyword appears in unrelated domains, they will all match the same policy. For long-term configurations, prefer DOMAIN or DOMAIN-SUFFIX and use DOMAIN-KEYWORD only as a verified supplement.

Why does the entire website still fail to load after adding DOMAIN-SUFFIX?

First record the hostnames associated with the failed resources. If sign-in, images, or media come from other domains, add separate DOMAIN or DOMAIN-SUFFIX rules. Do not put a URL path in the rule, because domain rules do not match paths.

Why is every website entering the proxy policy?

In Home, first check whether Global Routing was mistakenly set to Proxy. Then check whether the last Rule line is FINAL,DIRECT. If FINAL uses PROXY, every request not matched earlier will enter the proxy policy.

Why is nothing changing after editing the rules?

Open Config and confirm that you edited the currently selected configuration. Then return to Home, choose the Config mode, and re-establish the connection. Also check that the target rule appears before FINAL and that no broader rule earlier in the list matches first.

What should I do if manual rules disappear after a subscription update?

An update to subscription content may rewrite the associated configuration. Keep a local copy before editing and record your custom Rule entries. After updating, compare the configuration with your copy and restore the necessary lines. Confirm subscription validity and content with your own service provider.

Do I need separate domain rules for ports 80 and 443?

No. DOMAIN, DOMAIN-SUFFIX, and DOMAIN-KEYWORD match hostnames, not ports. Whether the same domain uses port 80, 443, or another port, one domain rule still determines the policy.

A reliable configuration checklist

First confirm Home → Global Routing → Config.
Then confirm that the selected file in Config is the one you just edited.
Place the exact DOMAIN rule before the broader DOMAIN-SUFFIX rule.
Keep DOMAIN-KEYWORD limited to the smallest scope supported by evidence.
Add IP-CIDR or GEOIP only when IP rules are needed.
Always keep FINAL,DIRECT on the last line.
After editing, test the target website and an ordinary website not covered by the rules separately.