How to Proxy Only Specific Websites in Shadowrocket: DOMAIN-SUFFIX and FINAL,DIRECT Rules

1. Check Config mode and your existing connection

Rules determine which policy a request uses; they don’t create a working proxy connection. Before you begin, check Home to confirm your existing subscription has been imported and the selected server connects successfully. This guide doesn’t provide, sell, or recommend nodes or subscriptions. The examples show local rule structure only and contain no usable service addresses.

In Home → Global Routing, select Config to route traffic according to the rules in the current configuration. Proxy routes traffic through a proxy overall, while Direct connects directly overall; neither is suitable for testing the domain-based routing described here. Scene is for selecting a scene, not for this basic verification, so avoid switching scenes while testing.

• Home: Check the selected server and connection toggle, then go to Global Routing and select Config.
• Config: Make sure the configuration you’re about to edit is the one currently enabled—not just another file with the same name that happens to be saved.
• Settings → On Demand: Note the current settings. On Demand affects when a connection starts automatically; it doesn’t assign a domain to PROXY.

Buying the app and using a proxy service are separate things: a one-time app purchase does not include a service plan. Shadowrocket is a closed-source commercial app available only on Apple platforms. The App Store is the only place to get it. System requirements for iPhone, iPad, and other compatible devices are listed on the App Store page.

2. Basic rules: target domains first, FINAL,DIRECT last

The code below belongs in the configuration’s [Rule] section; it isn’t a complete configuration file. example.com and example.net are sample domains—replace them with the domains you want to route. Don’t paste this block into the subscription URL field or use it to overwrite a complete configuration that includes settings such as DNS and policy groups.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-SUFFIX,example.net,PROXY
FINAL,DIRECT

DOMAIN-SUFFIX,example.com,PROXY matches example.com itself and its subdomains, such as www.example.com and api.example.com. Enter the domain only—without https://, a port, path, or query parameters. Similar-looking text doesn’t count: this rule won’t match notexample.com.

FINAL,DIRECT means use DIRECT when none of the preceding rules match. Rules are checked in order, and the first match determines the policy, so FINAL belongs at the end. If a broader PROXY rule appears earlier, those requests won’t reach FINAL. Changing only the last line doesn’t guarantee that everything else will connect directly.

Back up the full configuration first

In Config, save a copy of the original before editing the working copy. If the existing configuration contains multiple rule sections, rule-set references, or complex policies, check their order and purpose first. Don’t delete other settings you still need just to match the three-line example.

3. Choosing between DOMAIN-SUFFIX and DOMAIN-KEYWORD

If you know the target website’s root domain, use DOMAIN-SUFFIX first. DOMAIN-KEYWORD matches a string in the domain and usually covers a wider range; it doesn’t identify a website by name. For example, using example as a keyword may also route domains owned by others through PROXY if they contain the same string.

If you do need a keyword rule, add the following line before FINAL. Don’t add a long list of unchecked keywords: ordinary websites may match and be routed through PROXY, making it difficult to find which rule broadened the scope.

DOMAIN-KEYWORD,example,PROXY

Rules can’t distinguish pages on the same domain by their full URL path. When you visit https://example.com/news and https://example.com/account, DOMAIN-SUFFIX sees the same target domain. Don’t include a path in this rule and expect it to proxy only one page.

4. Apply the rules in Config in five steps

Keep variables to a minimum while editing: use the same device, network, and selected server, and change one set of rules at a time. Updating the server list in a subscription is separate from editing a local rule file. Refreshing a subscription doesn’t enable the Config you just edited.

1. Back up the configuration

   Open Config, find the configuration in use, and save a copy. Note which file was selected so you can switch back to the original if anything goes wrong.

2. Edit the rules

   Open the working copy for editing and find the [Rule] section. Place the target DOMAIN-SUFFIX rule before any broader rule that could conflict with it. If you need a direct-connection exception for a specific domain, put the more precise DOMAIN,DIRECT rule first.

3. Check the ending

   Make sure FINAL,DIRECT is the last rule, then check for any earlier PROXY rules that match all requests or cover an overly broad range. Save the changes, then enable the working copy in Config.

4. Select the mode

   Go to Home → Global Routing → Config. Confirm the selected server is available, then connect. Don’t test the rules in Proxy or Direct mode.

5. Test again

   Close existing webpage connections and try again; if needed, reconnect in Shadowrocket. In the connection log, check the target domain, matched rule, and resulting policy. Then test a website that isn’t listed in your rules.

5. Verify routing by checking requests, not just the page

A webpage typically requests multiple domains. The page itself, images, scripts, login APIs, and media may all use different domains. The main page matching PROXY doesn’t mean every dependent request matched the same rule. If the page loads but images are missing, check the actual domains used by the failed resources before switching Global Routing to Proxy for ongoing use.

This flow illustrates two things: seeing the VPN indicator only means the system tunnel is active; it doesn’t prove every request goes through a proxy server. A DIRECT request may still enter the tunnel before Shadowrocket routes it directly according to the rules. Don’t treat an active connection toggle as proof that all websites are using a proxy.

• Test the target website: Visit a domain in your rules and check that it matches the intended DOMAIN-SUFFIX rule and the resulting policy is PROXY.
• Test a comparison website: Visit a domain not covered by another rule and check that it reaches FINAL with DIRECT as the resulting policy.
• Test dependent resources: If part of a page fails, note the domains used by the failed requests. Add rules one at a time only if needed, rather than covering them all with an overly broad keyword.
• Check for reused connections: If an existing connection is still in use after you change the rules, close the page or app’s old connection before testing again. This prevents results from an existing connection being mistaken for results from the new rules.

Domain rules also depend on domain information being available in the request. Don’t assume DOMAIN-SUFFIX will match requests where an app connects directly to an IP address, uses a cached address, or relies on a special resolution method. To route by IP, check the IP-CIDR range and rule order separately. GEOIP matches the geographic location of an IP address; it doesn’t identify where a website’s operator is based.

6. When a site won’t load: distinguish DNS, connection, and rule issues

The messages below are network errors a browser may display, not fixed Shadowrocket pop-ups. Their appearance varies by browser. First identify where the failure occurs, then decide whether to change a rule. A timeout doesn’t automatically mean a rule is wrong, and a DNS failure doesn’t automatically mean the server is unavailable.

If every website goes through PROXY, first check whether Global Routing is still set to Proxy, then look for a broader matching rule above the target rules. If every website connects directly, confirm the current mode is Config, the working copy is enabled, and the domains aren’t entered as URLs with a scheme or path.

Check the rule and policy target separately

PROXY selects a proxy policy; it isn’t a protocol name. If the original configuration uses a custom policy group, make sure the name in the last column of the rule exists and check which outbound is selected in that group. The connection settings for protocols such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard aren’t changed by a DOMAIN-SUFFIX rule.

7. Frequently asked questions about routing specific websites

Keep a final configuration that makes the purpose of every rule clear: list target domains first, put necessary specific exceptions ahead of broader rules, and keep FINAL,DIRECT at the end. After adding a domain, test it and test an unrelated domain that should connect directly. This is more useful for confirming routing than repeatedly switching global modes.