DOMAIN vs DOMAIN-SUFFIX vs DOMAIN-KEYWORD

The three domain rule types differ in match breadth, strictest first:

• DOMAIN: exact equality only. DOMAIN,www.google.com,Proxy matches www.google.com and nothing else — not even google.com;
• DOMAIN-SUFFIX: the domain itself plus all subdomains. DOMAIN-SUFFIX,google.com,Proxy matches google.com, mail.google.com, a.b.google.com. The most used and most recommended type;
• DOMAIN-KEYWORD: any domain containing the string. DOMAIN-KEYWORD,google,Proxy catches everything with "google" in it — including googleusercontent.com, and also the unexpected fakegoogle-phishing.com.

Choosing

Default to DOMAIN-SUFFIX when adding rules — its scope is predictable. Reach for KEYWORD only when the domains are too varied to enumerate (e.g. DOMAIN-KEYWORD,youtube covering the ytimg/youtube family), accepting the false-positive risk. Use DOMAIN when subdomains must route differently — e.g. a site's API subdomain direct while the main site goes through the proxy.