Partition domain-anchored rules (||domain...) into map[string][]*Rule keyed by domain suffix. At match time, walk up the hostname hierarchy and only check rules for matching domains instead of scanning all rules. Same approach for exceptions. Pre-lowercase URL and context once per request to eliminate redundant strings.ToLower calls in each rule match.