diff --git a/app/src/main/java/chat/vojo/proxy/core/ProxyConfig.kt b/app/src/main/java/chat/vojo/proxy/core/ProxyConfig.kt
index ad552ce..8f10584 100644
--- a/app/src/main/java/chat/vojo/proxy/core/ProxyConfig.kt
+++ b/app/src/main/java/chat/vojo/proxy/core/ProxyConfig.kt
@@ -66,6 +66,14 @@ data class ProxyConfig(
     }
 }
 
+/**
+ * Global default for destination-based ("Сайты") routing of tunnelled traffic.
+ * [routedSites] entries are exceptions to this default. With [PROXY_ALL] (the legacy
+ * behaviour) listed sites go direct; with [DIRECT_ALL] listed sites go through the proxy.
+ */
+@Serializable
+enum class RoutingMode { PROXY_ALL, DIRECT_ALL }
+
 /** App-wide settings persisted alongside the server list. */
 @Serializable
 data class AppSettings(
@@ -76,4 +84,14 @@ data class AppSettings(
     /** DNS server queried by routed apps; sent through the tunnel for privacy. */
     val dns: String = "1.1.1.1",
     val mtu: Int = 8500,
+    /** Global proxy-vs-direct default for domain routing; [routedSites] are the exceptions. */
+    val routingMode: RoutingMode = RoutingMode.PROXY_ALL,
+    /**
+     * Domain-routing override entries. Each is either an explicit suffix domain
+     * (`example.com`, matches itself and all subdomains) or a bundled category
+     * reference (`geosite:google`). Non-empty turns on hev mapped-DNS so the local
+     * SOCKS5 bridge sees domains and can split proxy-vs-direct (see docs/architecture.md).
+     * Empty + [RoutingMode.PROXY_ALL] = legacy all-through-proxy behaviour (feature inert).
+     */
+    val routedSites: Set<String> = emptySet(),
 )