When Shadowrocket nodes look fine but pages do not, revert DNS to the last mode that worked (often remote or DoH), clear Safari, reconnect. If Fake-IP breaks login, disable Fake-IP; do not shred the subscription.

Pretty rules cannot help if lookups leave through the carrier. Background: What is DNS.

Change one knob

  1. Global mode, known-good site.
  2. DoH versus plain remote only.
  3. Disable Fake-IP and retry the bank app.
  4. Then rules: policy groups.

Pick a DoH host whose operator you can name. Low Data Mode on iOS can stall DoH; toggle it once. Skip fancy DNS on captive portals until you have authenticated.

Build 3.2.1 sits on the download page. Fetch issues: update fail. FAQ, guides.

Field questions tied to this guide

  • Who wins: iOS DNS or the app? While the VPN is up, Shadowrocket should. Carrier DNS typed in Settings can leak queries.
  • What is Fake-IP? A placeholder address until the real lookup happens inside the tunnel. Some banks and games hate it.
  • Is DoH automatically safer? The query is in HTTPS. The operator of that DoH host still sees names. Do not pick a stranger because they look nearby.
  • Reinstall to reset DNS? No. Toggle, reconnect. Reinstall only for a bad build from the download page.

Change one control, then retest

While working through “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”, write the download-page version, mode, protocol, and node name on the first line of a note. After each toggle, run one check only: 1.1.1.1/help or the exact page that failed. Changing Kill Switch, split rules, and nodes together makes the next failure un-debuggable. Get Shadowrocket packages only from the download page; permissions and device limits live in the FAQ and guides.

On office or hotel networks, finish captive portals and clear leftover PAC entries before you decide this article’s failure mode applies. A cellular A/B exposes router DNS and parental filters quickly. Avoid hammering login on a second device during the test so session kickouts are not mistaken for radio drops.

Pin the combination that works—SSID, node, protocol—and reuse it on that network instead of starting from Auto every time. Keeping slug rocket-doh-fake-ip as your note title makes the write-up searchable later.

When to stop and change layers

After five identical failures, stop. Recheck the documented build, confirm a single tunnel client, ensure Kill Switch was not blocking a portal, and verify the browser is not Direct in a split list. Stopping is how you escape the wrong layer.

When you ask for help, include time, SSID, mode, protocol, node names, and steps already tried. After recovery, verify egress in a clean browser so cache does not fake success, then write the split list or favorites back into your notes before the next reinstall.

Extra pass for “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.

Extra pass for “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.

Extra pass for “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.

Extra pass for “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.

Extra pass for “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.

Extra pass for “Shadowrocket DNS: DoH, Fake-IP, and ping-works-Safari-doesn’t”: retest three minutes on a second network and confirm the download page build. If only one app fails, inspect split membership; if everything fails, inspect permissions and DNS first. One change at a time remains the fastest habit when debugging Shadowrocket.