App Routing
On iOS, App Routing uses an app's domains and destination IPs to choose an output. It does not match the originating app's bundle ID.
- Domain sets: named domain suffixes; the most specific suffix wins.
- Domain keywords (2.1.0): literal substrings of the DNS name; the first keyword in saved order wins, after domain sets.
- CIDR and CIDR sets: destination IP ranges; packet routes use longest-prefix matching.
- DNS fallback: policy for names with no user domain match, after ad filtering.
- VPN DNS Server Domains: the reserved bootstrap path for hostname-based encrypted VPN DNS upstreams.
- Default: final IP route for remaining traffic.
DNS resolution and packet routing are related decisions with different priorities. Read the Routing Rules Engine for the complete order, overlapping-rule examples, and the relationship with static records and ad filtering.
Use Rules Mode for these custom policies. Simple Mode keeps them saved but selects one ordinary output; its DNS ad filter can still run.