diff --git a/easytier/src/peers/peer_ospf_route.rs b/easytier/src/peers/peer_ospf_route.rs
index 04471b0f..55bff36e 100644
--- a/easytier/src/peers/peer_ospf_route.rs
+++ b/easytier/src/peers/peer_ospf_route.rs
@@ -69,6 +69,7 @@ use crate::{
     },
     use_global_var,
 };
+use crate::proto::dns::DeterministicDigest;
 
 use super::{
     graph_algo::dijkstra_with_first_hop,
@@ -260,7 +261,7 @@ impl RoutePeerInfo {
             ipv6_addr: global_ctx.get_ipv6().map(|x| x.into()),
 
             groups: global_ctx.get_acl_groups(my_peer_id),
-            dns: Some(global_ctx.config.get_dns().export()),
+            dns: global_ctx.config.get_dns().export().digest(),
 
             noise_static_pubkey,
 
diff --git a/easytier/src/proto/dns.rs b/easytier/src/proto/dns.rs
index 22dce587..44e5658d 100644
--- a/easytier/src/proto/dns.rs
+++ b/easytier/src/proto/dns.rs
@@ -1,7 +1,21 @@
+use serde::Serialize;
+use sha2::{Digest, Sha256};
 use std::fmt::Display;
 
 include!(concat!(env!("OUT_DIR"), "/dns.rs"));
 
+pub trait DeterministicDigest: Serialize {
+    fn digest(&self) -> Vec<u8> {
+        let json = serde_json::to_vec(self).expect("failed to serialize the object to json");
+        let mut hasher = Sha256::new();
+        hasher.update(json);
+        hasher.finalize().to_vec()
+    }
+}
+
+impl DeterministicDigest for DnsConfigPb {}
+impl DeterministicDigest for ZoneConfigPb {}
+
 impl Display for ZoneConfigPb {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         writeln!(f, "; EasyTier Magic DNS zone file")?;
diff --git a/easytier/src/proto/peer_rpc.proto b/easytier/src/proto/peer_rpc.proto
index 7f4e8c46..23e91998 100644
--- a/easytier/src/proto/peer_rpc.proto
+++ b/easytier/src/proto/peer_rpc.proto
@@ -48,7 +48,7 @@ message RoutePeerInfo {
   // Trusted credential public keys published by admin nodes (holding network_secret)
   repeated TrustedCredentialPubkeyProof trusted_credential_pubkeys = 19;
 
-  dns.DnsConfigPb dns = 20;
+  bytes dns = 20;
 }
 
 message PeerIdVersion {