Proxies for Essential Sites: Domain Routing in sing-box and mihomo

A typical situation: you need to open a store on the German Amazon with a German IP, a supplier account from the USA with an American one, while YouTube, work messengers, and system updates can go directly. Using a proxy "for the entire system" is inconvenient and expensive: when paying for a gigabyte through a proxy, all background traffic is consumed. Turning it on and off manually means you'll forget at the most inconvenient moment. The solution is domain routing: the local client decides which site to route through which proxy and which to connect directly. Below are working configurations for the two most popular engines of 2026, sing-box and mihomo (formerly Clash Meta), along with an analysis of the pitfalls where the scheme usually breaks down.

Why this is better than browser proxies and PAC files

A proxy in the browser settings or an extension only works for that browser. A PAC file can choose a proxy by domain, but it also lives within the browser and system settings — a desktop marketplace client, Telegram, a Python script, or a console utility will simply ignore it.

sing-box and mihomo work at a lower level: they create a virtual network interface (TUN mode) and route traffic from all programs through themselves. Each connection then goes through a list of rules: domain, IP subnet, process name, port. If a rule matches, the connection goes to the specified exit (the proxy of the required country or a direct connection).

What this means in practice:

• Traffic savings. Only working sites go through the paid proxy, while videos, updates, and cloud backups go directly.
• Multiple countries simultaneously. amazon.de goes through the German exit, walmart.com through the American one, without switching.
• Rules by programs. You can send a specific process entirely to the proxy (for example, a desktop client or script) without affecting others.
• Fewer human errors. You don’t need to remember if the proxy is on — the site always opens with the “correct” IP.

What you will need

• A proxy that supports SOCKS5 or HTTP with login and password authentication. Both engines can pass the login and password themselves, so a local gateway is not needed.
• A client: for sing-box — official applications for Android, iOS, and macOS or a core for Windows/Linux; for mihomo — graphical interfaces like Clash Verge Rev or FlClash.
• A list of domains that should go through the proxy. It’s worth compiling this in advance — more on that below.

Option 1: sing-box (versions 1.12 and newer)

An important note about versions. Many configurations from the internet are written for the old sing-box and do not run on current builds. According to the official list of deprecated features: geosite and geoip were removed in 1.12.0 (replaced by rule-set), the outbound field inside rules was replaced with actions ("action": "route") starting from 1.11, old DNS server formats were removed in 1.14.0, and special exits block and dns were removed even earlier in 1.13.0. The current stable branch at the time of writing is 1.14.

The minimum working configuration: a German residential proxy for a couple of domains, everything else goes directly.

{
  "log": { "level": "info" },
  "dns": {
    "servers": [ { "type": "local", "tag": "local" } ]
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "address": [ "172.18.0.1/30" ],
      "auto_route": true,
      "strict_route": true
    }
  ],
  "outbounds": [
    {
      "type": "socks",
      "tag": "resi-de",
      "server": "HOST_FROM_ACCOUNT",
      "server_port": 1080,
      "username": "LOGIN",
      "password": "PASSWORD"
    },
    { "type": "direct", "tag": "direct" }
  ],
  "route": {
    "auto_detect_interface": true,
    "default_domain_resolver": "local",
    "rules": [
      { "action": "sniff" },
      { "protocol": "dns", "action": "hijack-dns" },
      {
        "network": "udp",
        "port": 443,
        "domain_suffix": [ "amazon.de", "otto.de" ],
        "action": "reject"
      },
      {
        "domain_suffix": [ "amazon.de", "otto.de", "ipinfo.io" ],
        "action": "route",
        "outbound": "resi-de"
      }
    ],
    "final": "direct"
  }
}

Fill in the host, port, login, and password from your provider's account. The port 1080 here is just an example.

What each part does

1. TUN input (auto_route) wraps all system traffic in sing-box. strict_route on Windows additionally adds firewall rules against DNS leaks (the documentation warns that this may break some programs, such as VirtualBox).
2. "action": "sniff" — the key line. Connections come to IP addresses through TUN, not domains. Sniffing retrieves the site name from the TLS handshake (SNI) or HTTP header, and only after that do the domain_suffix rules start to apply. Without this line, domain rules do not work silently — a common reason for "config not applying."
3. hijack-dns intercepts system DNS requests and forwards them to the DNS module of sing-box.
4. The rule with reject for UDP 443 disables QUIC (HTTP/3) for proxied domains. The browser will revert to regular HTTPS over TCP, which will go through the proxy. Why — in the section about pitfalls.
5. domain_suffix catches the domain and all its subdomains: amazon.de covers both www.amazon.de and sellercentral.amazon.de.
6. auto_detect_interface binds outgoing connections of sing-box to the physical network adapter. Without it, traffic to the proxy server will again end up in TUN, creating a routing loop.
7. final: direct — everything that does not match any rule goes directly.

Multiple countries and program rule

The second exit is added as another socks object with its own tag (for example, resi-us) and a separate rule. You can send an entire program to the proxy with a rule containing the process_name field (works on Windows, macOS, and Linux):

{
  "process_name": [ "python.exe" ],
  "action": "route",
  "outbound": "resi-us"
}

Rules are checked from top to bottom until the first match, so place specific rules above general ones.

Option 2: mihomo (Clash Meta)

mihomo is convenient because it has mature graphical interfaces, and the config is written in YAML, which is easier to read. The same scenario:

tun:
  enable: true
  stack: gvisor
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

dns:
  enable: true
  enhanced-mode: fake-ip
  nameserver:
    - https://1.1.1.1/dns-query

proxies:
  - name: resi-de
    type: socks5
    server: HOST_FROM_ACCOUNT
    port: 1080
    username: LOGIN
    password: PASSWORD

rule-providers:
  work-de:
    type: inline
    behavior: classical
    payload:
      - DOMAIN-SUFFIX,amazon.de
      - DOMAIN-SUFFIX,otto.de
      - DOMAIN-SUFFIX,ipinfo.io

rules:
  - RULE-SET,work-de,resi-de
  - MATCH,DIRECT

The main differences from sing-box:

• Fake-ip mode solves the problem of “connection coming to IP, not domain” differently: mihomo responds to DNS requests with a fake address, remembers which domain it corresponds to, and applies rules based on it. The actual site address is learned by the proxy server on its side.
• Rule set (rule-providers) can conveniently be kept as a separate list. The inline type stores domains directly in the config, while the http type pulls a list from a link and updates it at intervals, for example, a shared list from a team repository.
• MATCH is analogous to final: everything else goes directly.
• For program rules, there is PROCESS-NAME, which on Android accepts the application package name.

How to compile a list of domains and not miss any

A website is not just one domain. A marketplace loads images from a CDN, scripts from a separate domain, and authentication may live on a third. If the main domain goes through a German IP, but the entry domain comes from your real one, anti-fraud sees two different addresses in one session.

1. Open the website with developer tools (F12 → Network tab), go through a typical scenario: login, search, product card, account.
2. Write down all the domains from the Domain column. You can skip third-party counters and ads, but be sure to include the service's own domains (including CDN and authentication server).
3. Add them to the rule and repeat the scenario. In the sing-box log (level info) or in the connection tab of the mihomo interface, you can see which rule was triggered for each connection.
4. Keep a "control" domain like ipinfo.io in the list: it shows the proxy's IP, while a neighboring IP check service that is not in the list shows your real one. This way, you can quickly see that routing is working.

Pitfalls where the scheme breaks down

1. QUIC bypasses the proxy

Chrome and other browsers readily use major sites over HTTP/3, which means over UDP. Many proxy providers do not support UDP through SOCKS5 or have limited support. In the worst case, the connection goes elsewhere; in the best case, the site lags while the browser reverts to TCP. Therefore, in the sing-box config above, UDP on port 443 for working domains is explicitly rejected. In mihomo, a similar effect is easier to achieve by disabling QUIC in the browser (flag chrome://flags/#enable-quic).

2. DNS leak to the provider

If the working domain resolves locally through your internet provider's DNS, the site itself will not see this: the connection will still come from the proxy's IP. However, the provider and anyone who sees your DNS will know which sites you are opening. The fake-ip mode in mihomo and passing the domain to the proxy server after sniffing in sing-box mitigate this issue. More on checks and protection methods can be found in the analysis of DNS leak protection methods.

3. Conflict with another VPN or anti-detect

Two TUN interfaces at the same time guarantee chaos in routes. If the anti-detect browser profile already has its own proxy, it’s better to route its traffic out of TUN: use a process name rule to send the browser to direct, and then each profile will go through its own proxy as intended.

4. System routing does not replace anti-detect

All programs on the computer will connect to the network from one IP to the domain. This is fine for one store. But for 10 accounts on one platform — no: the platform sees the same browser fingerprint and one address. For multi-accounting, domain routing is an auxiliary tool, not a replacement for the combination of "separate profile + separate proxy."

5. IP rotation in the middle of a session

If the proxy is set to change IP with each request, the site with authentication will see a new address on each image load. For accounts, stores, and social networks, use a login with a sticky session (fixed IP during operation) or rotation by timer with intervals of tens of minutes.

6. Proxy without support for the required protocol

If the provider only offers HTTP proxies, use an exit of type http in sing-box, and type: http in mihomo. Both engines support login and password for HTTP as well. If the program itself cannot work with authenticated proxies and you don't want to raise TUN, a local gateway on gost, 3proxy, or Squid will suffice.

Which proxy to use in the rule

• Marketplaces, social networks, seller accounts, advertising accounts — residential proxies from the required country with a sticky session. The address of your home provider raises the least suspicion with anti-fraud.
• Platforms with the strictest checks (mobile applications, TikTok, Instagram) — mobile proxies: many real subscribers go online simultaneously with one operator's IP.
• APIs, documentation, package repositories, services without anti-bot protection — data center proxies: they are cheaper and faster, and for such tasks, a "home" IP is not needed.

It’s convenient to set up several exits of different types in the config and distribute domains among them, rather than routing everything through the most expensive one.

Conclusion

Domain routing transforms proxies from a "switch" into a precise tool: the necessary sites always open with the required IP, and other traffic does not waste paid gigabytes. To get started, 30 lines of config are enough. The main thing is not to forget sniffing (or fake-ip), disable QUIC for proxied domains, compile a complete list of service domains, and use the current syntax: configs for sing-box before 1.12 will not run on fresh versions.