Matching Destination Domains in Squid ACLs

Use a destination-domain ACL when the requirement concerns the host, rather than a word somewhere in a URL:

acl selected_sites dstdomain .example.com

The leading-dot form covers example.com and its subdomains. It does not make example.com.other.test part of that domain. Keep an exact-host selector when the policy permits only that host.

Choose the field before changing a pattern. dstdomain, dstdom_regex and url_regex examine different representations. A URL path/query containing domain-looking text does not name that destination.

Keep each ACL name on one type. Reusing a name for a domain list and regex does not merge their semantics; give different tests different names and combine them in the access or peer-selection rule.

The definition alone grants no access or parent route. Use it with the intended access decision while retaining authorized-client and other required conditions.

Keep intended base/subdomain matches and deceptive longer-name non-matches with the policy. Ordinary CONNECT can expose the destination host but not the encrypted page path, so a domain rule does not promise path inspection.