← Back to Docs

Domain Split-Tunneling

What It Does

This is the feature behind the routing diagram on the homepage: YouTube through one tunnel, Netflix through another, banking direct — without ever toggling a VPN switch. Each new connection is matched against your domain rules before it leaves, so the rule travels with the service, not just the device.

Domain routing lets you override the outbound path on a per-domain basis. You can create global rules from Routing Rules or device-specific rules from a device's Route by Domain panel. Rules are applied after the DNS query resolves — matched domains are intercepted and routed through the specified outbound regardless of the device's default assignment.

Common use cases: route your banking site direct while everything else goes through a VPN; send one streaming service through a specific country's tunnel; bypass a slow tunnel for latency-sensitive gaming.

Adding a Global Domain Route

  1. Go to the Routing Rules tab
  2. Switch to Route by Domain
  3. Under Add Domain Route, enter one domain, paste a URL, or add several domains at once. Entering netflix.com also covers subdomains that end in netflix.com
  4. Select the outbound: Direct, a specific VPN tunnel, or a tunnel group
  5. Click Add route (or Add N routes when adding multiple). These routes apply network-wide

To scope a domain route to one device only, open that device from Devices and use its Route by Domain panel instead.

Rule Precedence

From highest to lowest priority:

  1. Domain routes and app presets (explicit domain match)
  2. Per-device default outbound assignment
  3. Global default (Direct)

A device set to tunnel through Mullvad will still use Direct for a domain rule marked as direct, regardless of its device-level assignment.

App Presets

App presets are curated multi-domain bundles for popular services — streaming platforms, gaming services, and productivity tools. Instead of manually adding every CDN domain for a service, enable a preset and pick the outbound once. TLSOps maintains the domain list behind the scenes.

See App Presets for setup instructions.

Domain Route Limit

The domain-route limit is shared across global and per-device domain routes. The Free plan allows up to 5 total domain routes; paid plans allow more. App presets count separately under the app-route limit.