Exceptions to your General Setup, scoped to the exact traffic they should apply to — with a worked example.
General Setup is your one global fraud policy — how every lead is scored and what each signal does. A Custom Rule is a labelled exception to it: “for this specific traffic, use these settings instead.” Nothing it doesn't match is affected, so you can tighten one partner or one geo without touching the rest.
For each lead d0pe looks at the rules whose conditions match it, takes the one with the highest priority, and applies that rule's overrides on top of General Setup. A lead that matches no rule just uses General Setup. Only one rule ever wins — they don't stack.
Scope a rule by traffic provider, partner, flow and country. Every condition you set must match at once (AND); anything left on “Any” is ignored. A rule with no conditions at all matches every lead — which, paired with a Quick Template, is how you apply a blanket policy in one move.
The higher priority number wins. The pattern is to layer: a broad rule at a low number, and a sharper exception at a higher number on top. Example — priority 10 “geo DE → stricter”, and priority 20 “partner ACME in DE → allow proxies, they send app traffic”. A DE lead for ACME matches both; priority 20 wins, so ACME gets the looser policy while every other DE lead keeps the stricter one.
Two groups. Network signals — VPN, proxy, TOR, datacenter, duplicates, invalid phone — act on the connection. Hardware signals — extension injection, iframe realm de-sync, canvas noise, automated hardware, and Device/ASN collision — act on the device checks. Each signal is set to Inherit (use General Setup), Allow (through, unmarked), Flag (through, marked for QC) or Block (never delivered).
Device/ASN collision is the one worth knowing: it catches many “devices” sharing one hardware fingerprint from the same network provider across different IPs — the signature of an emulator or click farm. It's tuned not to false-positive on popular phone models, and its default action is Flag, never a hard ban. Switch it to Block inside a rule scoped to a cap that's under attack.
Presets that fill the whole override set in one click, so you tune from a sensible base rather than a blank slate: Default (inherit everything), Spam-Attack-Filter (block VPN/proxy/datacenter plus the main bot signals, for competitor spam and emulator sign-ups) and Aggressive Stealth (block everything, strictest).
When a rule needs a signal that hasn't been fetched yet, d0pe runs exactly the checker required — and only that one. A proxy rule pays for the IP lookup, not for HLR or SEON. This holds even with “external providers on incoming leads” switched off: a rule always gets the signal it asks for, so you can leave paid checks off by default and still have a rule that depends on one work.
The same guidance sits beside the rule editor in the app as the Smart Guide — the docs explain the model, the Smart Guide answers “what do I press right now”.