Shadowrocket DNS Settings: System DNS, Custom DNS, and DNS over HTTPS

Understand DNS, rule matching, and connection routing

DNS translates domain names into addresses that can be used to connect. A request in Shadowrocket may also be matched against a rule, which determines how the connection is routed. So a page that will not load is not necessarily a DNS problem: even if the domain resolves, the selected service may fail to connect. Conversely, when a rule depends on address information, the DNS result can affect which rule matches.

Check the connection status and Global Routing on Home. Proxy sends traffic through the selected connection, Direct connects without a proxy, Config applies the rules in the active configuration, and Scene follows its scene settings. Note the current routing mode before changing DNS. If you change both at once, it will be difficult to tell which change affected access.

Rules also work in different ways. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP checks an address's geographic location, and FINAL handles requests that did not match earlier rules. Changing DNS does not replace rules. For example, changing dns-server does not automatically turn FINAL,DIRECT into a proxy route.

What each DNS option does

System DNS is a good baseline for initial troubleshooting. It uses the resolver settings provided by the device's current network, so there is no server address to maintain manually. The upstream resolver may change when you switch between Wi-Fi and cellular. If a domain fails only on one network, record how it behaves on both.

Custom DNS is useful when you need to specify a resolver or compare results from different upstream servers. Traditional DNS commonly uses port 53; DoH uses an HTTPS connection, typically over port 443. The port tells you about the transport, not whether a domain will resolve successfully.

Set dns-server and DoH in Config

In Config, find the configuration in use and confirm it is the active one. Then edit its [General] section. Save a copy of the existing text first, especially any rules and other settings. Some configuration sources may overwrite manual edits. If the configuration is updated from a subscription you already use, check this section again after each update.

1. On Home, note the active configuration name and Global Routing, then choose a domain you can test consistently.
2. Open Config and edit [General] in the relevant configuration. Change only the DNS-related lines; leave the Rule section unchanged.
3. Save, return to Home, and retry on the same network with the same routing mode. If it fails, restore the previous value and check that the configuration text was saved correctly.

These snippets show three alternative ways to configure DNS. Do not stack all three example dns-server lines in the same [General] section. To use system DNS, write:

[General]
dns-server = system

To specify a resolver, set dns-server to an address that is actually reachable. The address below illustrates the field format only; test connectivity to determine whether it works on your network:

[General]
dns-server = 1.1.1.1

For DoH, set doh-server to the full HTTPS URL provided by the service. The example.com URL below illustrates the format and is not a working DoH server. Replace it with an address you have verified and check the current in-app field guidance for the correct syntax:

[General]
doh-server = https://example.com/dns-query

Verify changes and troubleshoot failures

Verify DNS and connectivity separately. First, check whether the target domain resolves to a result you can access on the same network. Then, once an address is available, check whether the request follows the expected rule and route. Testing just one webpage cannot distinguish between these layers: browser caches, the site's own status, and existing connections can all affect the result.

1. Before changing anything, note the network type, Global Routing, selected configuration, and target domain. Run Connectivity Test on Home to record a baseline connection status.
2. Save one DNS change, then disconnect and reconnect. First visit a domain that has worked reliably, then the domain you are troubleshooting. Record each result.
3. If both fail, check the spelling in [General], the DNS address, or whether the DoH URL is reachable. If only one domain fails, check its matching rule and the service itself.
4. Restore the original setting and test again. If access immediately returns, investigate the new setting further. If the problem remains, look for changes in the connection, network, or rules.

Pay particular attention to resolution results and rule order when using IP-CIDR or GEOIP rules. Rules are checked from top to bottom, and the first match affects what happens next. FINAL is a fallback; it does not override an earlier match. Check both the rules in Config and whether Config is selected as the routing mode on Home—not just the DNS fields.

Common questions and limitations

Shadowrocket is a paid app for Apple platforms, available only on the App Store. iPhone and iPad are its primary devices; compatibility with other devices and system requirements are listed on the App Store page. The app purchase and connection services are separate. This guide covers only in-app DNS settings and assumes you already have your own connection configuration.