Grok Keeps Spinning? Route X and xAI Domains in Clash: 2026 How-To

1. What “spinning Grok” usually means on the wire

End users describe the failure in product language: “Grok is stuck,” “the assistant never loads,” or “X login works once and then flakes.” Under the hood, those complaints map to familiar proxy triage patterns. The document shell may render while background fetches to xAI-labeled hosts hang, or OAuth handshakes bounce between X identity endpoints and third-party CDNs that your subscription marks as domestic DIRECT. Sometimes WebSocket or long-polling channels attach to hostnames you never added to YAML, so the UI waits forever for a stream that never authenticates.

Separating symptoms from superstition matters. If every hostname in the log shows the same proxy group and failures persist, you may genuinely need a healthier node or a provider-side incident. If the log mixes DIRECT and PROXY rows for related suffixes during one user gesture, fix routing first. The same discipline applies when only image previews fail: media CDNs for X often differ from the apex site, and a missing suffix looks like “broken thumbnails” rather than a DNS error page.

Before editing rules, confirm you are editing the active profile in your GUI. A surprisingly large share of “regressions” are two-file drift: one YAML on disk and another snapshot selected in the client. Once visibility is honest, the rest of this article is about evidence, not vibes.

2. A checklist that puts rule order ahead of node roulette

Rotating every node in a subscription feels productive; it usually wastes time when DNS or precedence is wrong. Walk this sequence instead.

1. Decide whether you are on system proxy or TUN, then confirm the browser or desktop shell actually honors that path for workers and redirects, not only the first navigation.
2. Open the live connection log, reproduce the spinner, and read the policy column per hostname. Unexpected DIRECT rows next to related PROXY rows are the primary signal.
3. Audit DNS: upstream reachability, fake-ip behavior, and optional nameserver-policy for x.com, x.ai, and any recurring CDN roots you capture.
4. Expand split rules to cover identity, API, static asset, and short-link hosts—not only the apex labels you remember from 2023.
5. After the path is coherent, pick stable nodes for long-lived HTTPS and avoid aggressive auto failover that reconnects mid-session.

If provider merges and validation errors still confuse you, skim our subscription import tutorial so you know where remote rule sets land relative to your local exceptions. The examples below assume you can insert user rules without breaking schema checks.

3. System proxy versus TUN for X tabs and Grok embeds

System proxy is still the gentle default when your workflow is mostly a Chromium-based browser and the OS settings propagate reliably. X access through a normal tab typically respects that mode. The classic failure remains: the first HTML request succeeds, then a service worker, extension, or helper executable issues parallel requests that ignore the proxy, so one async call never completes and the SPA looks “almost loaded.”

TUN mode pushes routing lower in the stack, which reduces accidental bypass at the cost of permissions and occasional conflicts with other VPN-class software. If you already walked through our TUN mode guide, reopen it while debugging Grok proxy issues specifically, then re-check the connection table for stray DIRECT rows that should not exist. TUN is not mandatory for everyone; it is the right experiment when logs prove stubborn escape paths despite correct YAML.

Embedded experiences deserve extra caution. When Grok surfaces inside another shell, the embedding page may enforce mixed content rules or additional DNS lookups. Treat those sessions as separate captures: filter logs for both the parent origin and the embedded iframe targets, then align policies so neither half starves the other.

4. DNS, fake-ip, and why social-plus-AI pages hurt

Clash’s fake-ip mode answers quickly with synthetic addresses, yet it also binds DNS tightly to rule evaluation. When the resolver and the rule engine disagree about what a name means, you see TLS retries, half-open HTTP/2 sessions, and interfaces that never transition from loading to interactive. Social graphs amplify the pain because a single view triggers dozens of hostnames within seconds, including analytics, media, and identity helpers.

A practical mitigation pairs reachable upstream resolvers with targeted policies—commonly nameserver-policy in Mihomo-class cores—for suffixes you observe repeatedly, such as x.com, x.ai, and media domains that appear beside thumbnails. Always verify keys against the documentation for the exact core version you ship; stale forum snippets love to break quietly across releases.

Corporate split-horizon DNS deserves an explicit mention. If internal resolvers rewrite certain public names to captive portals, your laptop may “resolve” while Clash still cannot complete the intended path. When only identity or CDN names fail while unrelated HTTPS succeeds, bring HAR or log excerpts to the network team instead of assuming the proxy core is wrong.

5. Collecting hostnames you can defend in a changelog

Static rule posts rot within weeks because CDNs and feature flags move. Treat any published list—including patterns in the table below—as hypotheses to verify in your own capture. Build a fresh inventory whenever the front end changes.

Open developer tools, enable preserve log on the Network tab, reload the X tab or Grok surface, and perform the action that triggers the spinner. Sort by domain and note document requests, XHR or fetch calls, scripts, styles, fonts, websocket upgrades, and redirect chains. Pay special attention to short-link hops: they often determine whether OAuth returns to the correct origin.

Reconcile browser names with the Clash connection log. If a hostname appears in DevTools but never in Clash, you still have a visibility problem—either bypass or a different network namespace—not a missing seventh DOMAIN-SUFFIX line. For desktop wrappers, repeat the exercise with platform tooling, then merge the two lists before editing YAML.

When you maintain team documentation, store captures with dates. Future you will appreciate the breadcrumb when a CDN migration suddenly invalidates yesterday’s suffix set.

6. Example buckets: X surface, xAI services, and shared edges

Group hosts so your profile stays readable. The boundaries shift; verify every suffix before you paste it into production YAML.

The illustration below reuses the standard blog artwork; the alt text states the routing intent for screen readers.

7. Rule snippets: explicit coverage and clean precedence

YAML fragments illustrate steering traffic to a proxy group named PROXY. Rename the token to match your real policy label and insert these lines before broad provider rules that might return DIRECT for “domestic” CDNs or generic keyword matches.

# Example only — replace PROXY with your policy group name
rules:
  - DOMAIN-SUFFIX,x.com,PROXY
  - DOMAIN-SUFFIX,twitter.com,PROXY
  - DOMAIN-SUFFIX,t.co,PROXY
  - DOMAIN-SUFFIX,x.ai,PROXY
  - DOMAIN-SUFFIX,twimg.com,PROXY

Add suffixes you measured rather than imaginary friends. If your subscription injects aggressive geo rules, duplicate critical lines in a user-controlled section that evaluates early, or merge providers so your exceptions win. Prefer DOMAIN-SUFFIX over DOMAIN-KEYWORD when precision allows; keywords that match unintended substrings create subtle outages elsewhere.

When experimentation calls for isolation, clone a dedicated group such as PROXY_XAI and point only the xAI and Grok proxy rules there so video or download traffic on other domains does not steal health checks from conversational sessions.

8. Node strategy: calm tunnels beat leaderboard chasing

Interactive assistants are not speed-test workloads. A node that flashes impressive latency but drops every minute forces TLS rebuilds that web apps interpret as “slow AI.” Pin Grok and X traffic to providers that stay up for multi-minute HTTPS sessions, damp flappy auto failover on those destinations, and avoid stacking multiple encapsulation products on the same flow.

If lossy networks are your norm, read Shadowsocks vs Trojan vs Hysteria2 for transport context. The goal is not a universal winner but a stack that matches your packet-loss profile for long-lived connections.

9. GUI workflow: Mihomo logs stay the source of truth

Desktop clients such as Clash Verge Rev expose live connections, DNS panes, and rule editors together. When Grok misbehaves, filter for substrings like x.ai, x.com, or twimg and read the chosen policy per row. If sensitive calls show DIRECT while siblings use PROXY, fix precedence before swapping servers.

If the baseline install still feels unfamiliar, follow the Clash Verge Rev setup guide for ports, subscriptions, and first launch before you chase assistant-specific ghosts. For YAML validation errors and core startup issues, keep the general Clash troubleshooting guide open in another tab.

10. How this differs from other AI routing guides on this blog

Our DeepSeek routing article targets a different provider graph, while the GitHub Copilot piece focuses on Microsoft sign-in and models hosts. The Claude guide centers on Anthropic endpoints. Grok proxy work intersects social timelines, short links, and xAI-branded subdomains, so the hostname set and failure textures differ even when the debugging choreography—capture, DNS, rule order, logs—is the same.

Keep the mental model portable: inventory first, DNS second, precedence third, nodes last. Skipping to “which flag icon pings fastest” throws away the information your connection table already offered.

11. Extensions, competing VPNs, and automation footguns

Browser extensions that inject their own proxies or “privacy” filters can reorder connection priorities in ways Clash never observes. Disable them briefly during triage. Running two VPN-class products at once still invites routing loops that masquerade as application bugs.

On mobile, per-app VPN behaviors diverge from desktop TUN; confirm whether your client supports equivalent Clash split rules and whether the browser you use actually rides the tunnel. The collection strategy still applies, but tooling may move from desktop DevTools to remote debugging.

Automation and CI jobs that call remote APIs inherit none of your laptop YAML unless you export proxy environment variables or run inside a routed namespace. The timeout pattern matches Grok spinners, yet the fix belongs in deployment configuration, not browser rules.

12. Close with evidence, not superstition

Grok spinners and flaky X login are maddening because the surfaces look polished even when the network path is fractured. Treat every endless loader as a prompt to open the log, read policies row by row, and reconcile DNS with the hostnames your browser actually requested. Split rules for x.com, x.ai, media neighbors, and redirectors are the mechanical layer; stable nodes are the polish once the path is honest.

Compared with ad hoc VPN toggles, a maintained desktop client with Mihomo integration keeps diagnostics visible and reduces YAML foot-guns when social and AI products iterate weekly. → Download Clash for free and experience the difference