# App Routing

On iOS, App Routing uses an app's domains and destination IPs to choose an output. It does not match the originating app's bundle ID.

- **Domain sets:** named domain suffixes; the most specific suffix wins.
- **Domain keywords (2.1.0):** literal substrings of the DNS name; the first keyword in saved order wins, after domain sets.
- **CIDR and CIDR sets:** destination IP ranges; packet routes use longest-prefix matching.
- **DNS fallback:** policy for names with no user domain match, after ad filtering.
- **VPN DNS Server Domains:** the reserved bootstrap path for hostname-based encrypted VPN DNS upstreams.
- **Default:** final IP route for remaining traffic.

DNS resolution and packet routing are related decisions with different priorities. Read the [Routing Rules Engine](core-components/routing-engine.md) for the complete order, overlapping-rule examples, and the relationship with static records and ad filtering.

Use Rules Mode for these custom policies. Simple Mode keeps them saved but selects one ordinary output; its DNS ad filter can still run.

[Profile routing fields](profile/routing.md) · [Internal DNS Server](core-components/internal-dns.md)