Shadowrocket DNS Setup: System DNS, Custom DNS, and DNS over HTTPS

Where DNS fits in the connection process

When you visit a domain, your device usually needs to find its IP address before it can connect. DNS handles that lookup; it is not the Shadowrocket connection switch and does not directly decide whether a request uses Proxy or Direct. Shadowrocket’s Global Routing controls the routing mode. When you select Config, the rules in your configuration also affect how requests are handled.

So if the connection is on but a domain won’t open, DNS isn’t automatically the cause. First distinguish between two cases: if only domain names fail while a known-reachable IP address connects, check DNS first. If both domains and IP addresses fail, also check the connection, routing mode, and status of any services you already use. Don’t conclude that all DNS settings are faulty based on one failed page load.

One more source of confusion: apps may use cached DNS results, and some requests may have their domain resolved by the other end of the connection. A page loading again doesn’t prove that the DNS setting you just changed handled the lookup. When troubleshooting, note the exact domain, network, and symptoms before and after each change so you don’t mistake a cache hit for a setting taking effect.

Choosing between system DNS, custom DNS, and DNS over HTTPS

System DNS uses the resolver settings provided by or currently active on your device’s network. The resolver may change when you switch between Wi-Fi and cellular. It’s a good starting point for troubleshooting: keep the default behavior, confirm that the connection and rules work, and then decide whether changing DNS is necessary.

Custom DNS lets you specify a DNS server address. Use it when you already have a known, working server address and want to compare DNS behavior across networks. Verify separately that the server is reachable and supports your current network. Entering an address doesn’t guarantee the same result for every domain, nor does it automatically encrypt queries.

DNS over HTTPS is often abbreviated to DoH. It describes how DNS queries are sent; it is not a new Global Routing mode, and you can’t turn a standard DNS server IP into DoH just by adding https://. DoH requires a valid HTTPS endpoint. The initial lookup of the endpoint’s hostname and the route used to connect to it can also affect the result.

Setting dns-server in Config: format and scope

To edit a configuration file, first open Config and confirm which configuration is actually in use—not an inactive copy. dns-server belongs in the [General] section, not as a rule under [Rule]. Save your changes, then return to Home to check the active configuration and Global Routing. To use the configuration’s rules, select Config mode.

[General]
dns-server = system

In the example, system means to use system DNS. To show custom addresses, separate IP addresses in the same field with commas. The addresses below are reserved for documentation and illustrate the format only; don’t enter them as working DNS servers:

[General]
dns-server = 192.0.2.53, 198.51.100.53

1. Keep the [General] section and write the field name as dns-server. The space around the equals sign is optional and included for readability.
2. For actual use, replace the example addresses with the IP address of a DNS server you’ve confirmed is reachable. Don’t put a subscription link, domain rule, or DoH URL in this IP address example.
3. After saving, check which configuration is active. If you test in Direct or Proxy mode, record each result separately; these are not the same rule environment.

Don’t assume that multiple addresses mean the first one always handles every query and the second is used only if it fails. Selection and fallback behavior depend on the configuration and network conditions. To test a specific server, keep only that address temporarily, then restore your original configuration. The address list in dns-server is not a speed ranking.

What else to check when setting up DNS over HTTPS

Open Settings → DNS and review the available DNS options. If the interface has a field for DNS over HTTPS, enter a complete HTTPS endpoint that you already know is available, then save it in the app. A DoH endpoint looks like https://dns.example.com/dns-query; the hostname here illustrates URL structure and is not a working service address. Don’t enter this URL in the dns-server line shown above, which uses server IP addresses.

DoH changes how the DNS queries it handles are sent, but it doesn’t guarantee that web requests follow the same route. Queries may still fail if the endpoint is unreachable on your network or its hostname can’t be resolved in the first place. Confirm that the endpoint is complete and the service is available, then check the connection and rules to understand the request route.

For example, DOMAIN-SUFFIX,example.com,DIRECT routes matching domains through DIRECT; it is not syntax for specifying a DNS server. Rules such as GEOIP and IP-CIDR match addresses, while FINAL handles requests not matched by earlier rules. Changing DNS may change the IP address returned, but that doesn’t mean every rule match will necessarily change.

Still can’t connect? Troubleshoot by symptom

Keep your test conditions consistent: use the same network, domain, and Global Routing mode, and change only one DNS setting. Record specific symptoms—such as “domain won’t resolve,” “connection times out after resolution,” or “only one app fails”—rather than simply “doesn’t work.” This makes the issue easier to pinpoint. After a test, restore the original setting and check whether the issue returns.

After troubleshooting, keep a copy of the settings you’ve verified work. For a refresher on Home, Config, and connecting, continue with the getting-started guide. Shadowrocket is a paid Apple-platform app available through the App Store. Compatibility and system requirements for iPhone, iPad, and other devices are as listed on the App Store page. Purchasing the app is separate from DNS services and the services provided by any subscription you already have.