diff --git a/easytier/src/common/config.rs b/easytier/src/common/config.rs
index d8bdc3cf..651728be 100644
--- a/easytier/src/common/config.rs
+++ b/easytier/src/common/config.rs
@@ -1,16 +1,15 @@
-use std::{
-    hash::Hasher,
-    net::{IpAddr, SocketAddr},
-    path::PathBuf,
-    sync::{Arc, Mutex},
-};
-
 use anyhow::Context;
 use base64::{prelude::BASE64_STANDARD, Engine as _};
 use cfg_if::cfg_if;
 use clap::builder::PossibleValue;
 use clap::ValueEnum;
 use serde::{Deserialize, Serialize};
+use std::{
+    hash::Hasher,
+    net::{IpAddr, SocketAddr},
+    path::PathBuf,
+    sync::{Arc, Mutex},
+};
 use strum::{Display, EnumString, VariantArray};
 use tokio::io::AsyncReadExt as _;
 
@@ -125,9 +124,6 @@ pub trait ConfigLoader: Send + Sync {
     fn get_id(&self) -> uuid::Uuid;
     fn set_id(&self, id: uuid::Uuid);
 
-    fn get_hostname(&self) -> String;
-    fn set_hostname(&self, name: Option<String>);
-
     fn get_inst_name(&self) -> String;
     fn set_inst_name(&self, name: String);
 
@@ -210,6 +206,12 @@ pub trait ConfigLoader: Send + Sync {
     fn get_dns(&self) -> DnsConfig;
     fn set_dns(&self, dns: DnsConfig);
 
+    fn get_hostname(&self) -> String;
+    fn set_hostname(&self, hostname: &str);
+
+    fn get_fqdn(&self) -> String;
+    fn set_fqdn(&self, fqdn: &str);
+
     fn dump(&self) -> String;
 }
 
@@ -430,7 +432,8 @@ pub fn process_secure_mode_cfg(mut user_cfg: SecureModeConfig) -> anyhow::Result
     Ok(user_cfg)
 }
 
-#[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
+#[derive(Debug, Clone, PartialEq, Default, Deserialize, Serialize)]
+#[serde(default)]
 struct Config {
     netns: Option<String>,
     hostname: Option<String>,
@@ -447,7 +450,7 @@ struct Config {
     peer: Option<Vec<PeerConfig>>,
     proxy_network: Option<Vec<ProxyNetworkConfig>>,
 
-    dns: Option<DnsConfig>,
+    dns: DnsConfig,
 
     vpn_portal_config: Option<VpnPortalConfig>,
 
@@ -533,6 +536,22 @@ impl TomlConfigLoader {
 }
 
 impl ConfigLoader for TomlConfigLoader {
+    fn get_id(&self) -> uuid::Uuid {
+        let mut locked_config = self.config.lock().unwrap();
+        match locked_config.instance_id {
+            Some(id) => id,
+            None => {
+                let id = uuid::Uuid::new_v4();
+                locked_config.instance_id = Some(id);
+                id
+            }
+        }
+    }
+
+    fn set_id(&self, id: uuid::Uuid) {
+        self.config.lock().unwrap().instance_id = Some(id);
+    }
+
     fn get_inst_name(&self) -> String {
         self.config
             .lock()
@@ -546,33 +565,6 @@ impl ConfigLoader for TomlConfigLoader {
         self.config.lock().unwrap().instance_name = Some(name);
     }
 
-    fn get_hostname(&self) -> String {
-        let hostname = self.config.lock().unwrap().hostname.clone();
-
-        match hostname {
-            Some(hostname) => {
-                let hostname = hostname
-                    .chars()
-                    .filter(|c| !c.is_control())
-                    .take(32)
-                    .collect::<String>();
-
-                if !hostname.is_empty() {
-                    self.set_hostname(Some(hostname.clone()));
-                    hostname
-                } else {
-                    self.set_hostname(None);
-                    gethostname::gethostname().to_string_lossy().to_string()
-                }
-            }
-            None => gethostname::gethostname().to_string_lossy().to_string(),
-        }
-    }
-
-    fn set_hostname(&self, name: Option<String>) {
-        self.config.lock().unwrap().hostname = name;
-    }
-
     fn get_netns(&self) -> Option<String> {
         self.config.lock().unwrap().netns.clone()
     }
@@ -678,22 +670,6 @@ impl ConfigLoader for TomlConfigLoader {
             .unwrap_or_default()
     }
 
-    fn get_id(&self) -> uuid::Uuid {
-        let mut locked_config = self.config.lock().unwrap();
-        match locked_config.instance_id {
-            Some(id) => id,
-            None => {
-                let id = uuid::Uuid::new_v4();
-                locked_config.instance_id = Some(id);
-                id
-            }
-        }
-    }
-
-    fn set_id(&self, id: uuid::Uuid) {
-        self.config.lock().unwrap().instance_id = Some(id);
-    }
-
     fn get_network_identity(&self) -> NetworkIdentity {
         self.config
             .lock()
@@ -874,11 +850,27 @@ impl ConfigLoader for TomlConfigLoader {
     }
 
     fn get_dns(&self) -> DnsConfig {
-        self.config.lock().unwrap().dns.clone().unwrap_or_default()
+        self.config.lock().unwrap().dns.clone()
     }
 
     fn set_dns(&self, dns: DnsConfig) {
-        self.config.lock().unwrap().dns = Some(dns);
+        self.config.lock().unwrap().dns = dns;
+    }
+
+    fn get_hostname(&self) -> String {
+        self.config.lock().unwrap().dns.get_name().to_string()
+    }
+
+    fn set_hostname(&self, hostname: &str) {
+        self.config.lock().unwrap().dns.set_name(hostname);
+    }
+
+    fn get_fqdn(&self) -> String {
+        self.config.lock().unwrap().dns.get_fqdn().to_string()
+    }
+
+    fn set_fqdn(&self, fqdn: &str) {
+        self.config.lock().unwrap().dns.set_fqdn(fqdn);
     }
 
     fn dump(&self) -> String {
diff --git a/easytier/src/core.rs b/easytier/src/core.rs
index 7b494e92..f406f603 100644
--- a/easytier/src/core.rs
+++ b/easytier/src/core.rs
@@ -797,9 +797,10 @@ impl NetworkOptions {
     }
 
     fn merge_into(&self, cfg: &TomlConfigLoader) -> anyhow::Result<()> {
-        if self.hostname.is_some() {
-            cfg.set_hostname(self.hostname.clone());
-        }
+        // TODO: remove hostname
+        // if self.hostname.is_some() {
+        //     cfg.set_hostname(&self.hostname.clone());
+        // }
 
         let old_ns = cfg.get_network_identity();
         let network_name = self.network_name.clone().unwrap_or(old_ns.network_name);
diff --git a/easytier/src/instance/instance.rs b/easytier/src/instance/instance.rs
index 5cd83634..d3a12ef5 100644
--- a/easytier/src/instance/instance.rs
+++ b/easytier/src/instance/instance.rs
@@ -212,7 +212,7 @@ impl InstanceConfigPatcher {
         let global_ctx = weak_upgrade(&self.global_ctx)?;
         if let Some(hostname) = patch.hostname {
             global_ctx.set_hostname(hostname.clone());
-            global_ctx.config.set_hostname(Some(hostname));
+            global_ctx.config.set_hostname(&hostname);
         }
         if let Some(ipv4) = patch.ipv4 {
             if !global_ctx.config.get_dhcp() {
diff --git a/easytier/src/launcher.rs b/easytier/src/launcher.rs
index b9061077..69e354a7 100644
--- a/easytier/src/launcher.rs
+++ b/easytier/src/launcher.rs
@@ -492,7 +492,7 @@ impl NetworkConfig {
                 .parse()
                 .with_context(|| format!("failed to parse instance id: {:?}", self.instance_id))?,
         );
-        cfg.set_hostname(self.hostname.clone());
+        self.hostname.as_ref().map(|n| cfg.set_hostname(n));
         cfg.set_dhcp(self.dhcp.unwrap_or_default());
         cfg.set_inst_name(self.network_name.clone().unwrap_or_default());
 
@@ -1033,8 +1033,7 @@ mod tests {
             config.set_dhcp(rng.gen_bool(0.5));
 
             if rng.gen_bool(0.7) {
-                let hostname = format!("host-{}", rng.gen::<u16>());
-                config.set_hostname(Some(hostname));
+                config.set_hostname(&format!("host-{}", rng.gen::<u16>()));
             }
 
             config.set_network_identity(crate::common::config::NetworkIdentity::new(
diff --git a/easytier/src/peers/foreign_network_manager.rs b/easytier/src/peers/foreign_network_manager.rs
index cc06d4dd..5507e430 100644
--- a/easytier/src/peers/foreign_network_manager.rs
+++ b/easytier/src/peers/foreign_network_manager.rs
@@ -239,11 +239,11 @@ impl ForeignNetworkEntry {
     ) -> ArcGlobalCtx {
         let config = TomlConfigLoader::default();
         config.set_network_identity(network.clone());
-        config.set_hostname(Some(format!(
+        config.set_hostname(&format!(
             "{}{}",
             PUBLIC_SERVER_HOSTNAME_PREFIX,
             global_ctx.get_hostname()
-        )));
+        ));
         config.set_secure_mode(global_ctx.config.get_secure_mode());
 
         let mut flags = config.get_flags();