diff --git a/example.config.toml b/example.config.toml
index 3f7bea7..917d69e 100644
--- a/example.config.toml
+++ b/example.config.toml
@@ -51,6 +51,54 @@ cloak-port = 443
 # Pass filepath here or '-' if you want to dump into stdout.
 access-file = "-"
 
+# network defines different network-related settings
+[network]
+# please be aware that mtg needs to do some external requests. For
+# example, if you do not pass public ips, it will request your public ip
+# address from some external service.
+#
+# As for 2.0, if you set a public-ip on your own, mtg won't issue any
+# network requests except of those required for Telegram.
+#
+# so, in order of doing them, it needs to do DNS lookup. mtg ignores DNS
+# resolver of the operating system and uses DOH instead. This is a host
+# it has to access.
+#
+# By default we use Quad9.
+doh-hostname = "9.9.9.9"
+
+# public ip addresses of the server. Actually, it is required only to
+# generate a correct access file. if you use default values here, mtg
+# will try to resolve these IPs on its own.
+[network.public-ip]
+ipv4 = ""
+ipv6 = ""
+
+# you can redefine a dialer for mtg. Dialer is how we 'dial' to either
+# some external services or telegram. empty string means default
+# connectivity.
+#
+# it is also possible to use socks5 or shadowsocks here
+#
+# socks5 example:
+#   socks5://user:password@host:port
+# shadowsocks example (SIP002):
+#   ss://YWVzLTEyOC1nY206dGVzdA@192.168.100.1:8888
+#
+# You can define 2 dialers here: telegram and default. Telegram dialer
+# is used to connect to Telegram servers only. Default is used for other
+# purposes, like accessing ifconfig.co to obtains public address (DNS is
+# resolved via DoH)
+#
+# Please also be aware that dialers are only doing TCP. If UDP is
+# required (for statsd for example), then these dialers are going to be
+# ignored.
+#
+# If telegram dialer is not defined, a default one is going to be used.
+[network.dialers]
+telegram = ""
+default = ""
+
 # FakeTLS can compare timestamps to prevent probes. Each message has
 # encrypted timestamp. So, mtg can compare this timestamp and decide if
 # we need to proceed with connection or not.
@@ -81,38 +129,6 @@ max-size = "16mb"
 # TTL for each cache record.
 ttl = "8h"
 
-# public ip addresses of the server. Actually, it is required only to
-# generate a correct access file. if you use default values here, mtg
-# will try to resolve these IPs on its own.
-[public-ip]
-ipv4 = ""
-ipv6 = ""
-
-# you can redefine a dialer for mtg. Dialer is how we 'dial' to either
-# some external services or telegram. empty string means default
-# connectivity.
-#
-# it is also possible to use socks5 or shadowsocks here
-#
-# socks5 example:
-#   socks5://user:password@host:port
-# shadowsocks example (SIP002):
-#   ss://YWVzLTEyOC1nY206dGVzdA@192.168.100.1:8888
-#
-# You can define 2 dialers here: telegram and default. Telegram dialer
-# is used to connect to Telegram servers only. Default is used for other
-# purposes, like accessing ifconfig.co to obtains public address (DNS is
-# resolved via DoH)
-#
-# Please also be aware that dialers are only doing TCP. If UDP is
-# required (for statsd for example), then these dialers are going to be
-# ignored.
-#
-# If telegram dialer is not defined, a default one is going to be used.
-[dialers]
-telegram = ""
-default = ""
-
 # statsd statistics integration.
 [stats.statsd]
 # enabled/disabled
diff --git a/go.sum b/go.sum
index fd68855..684fcb8 100644
--- a/go.sum
+++ b/go.sum
@@ -9,12 +9,14 @@ github.com/pelletier/go-toml v1.8.1 h1:1Nf83orprkJyknT6h7zbuEGUEjcyVlCxSUGTENmNC
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 h1:f/FNXud6gA3MNr8meMVVGxhp+QBTqY91tM8HjEuMjGg=
 github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3/go.mod h1:HgjTstvQsPGkxUsCd2KWxErBblirPizecHcpD3ffK+s=
 github.com/shadowsocks/go-shadowsocks2 v0.1.4 h1:4VzajPL7RwwmImysBSvI+lm/UaegDGQq3hr42dYo3gs=
 github.com/shadowsocks/go-shadowsocks2 v0.1.4/go.mod h1:AGGpIoek4HRno4xzyFiAtLHkOpcoznZEkAccaI/rplM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 h1:/ZScEX8SfEmUGRHs0gxpqteO5nfNW6axyZbBdw9A12g=
@@ -33,4 +35,5 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/mtglib/network/network.go b/mtglib/network/network.go
index 83cb4f7..bc3d84e 100644
--- a/mtglib/network/network.go
+++ b/mtglib/network/network.go
@@ -30,9 +30,11 @@ func (d *Network) DialContext(ctx context.Context, network, address string) (net
 		return nil, fmt.Errorf("cannot resolve dns names: %w", err)
 	}
 
-	rand.Shuffle(len(ips), func(i, j int) {
-		ips[i], ips[j] = ips[j], ips[i]
-	})
+	if len(ips) > 1 {
+		rand.Shuffle(len(ips), func(i, j int) {
+			ips[i], ips[j] = ips[j], ips[i]
+		})
+	}
 
 	for _, v := range ips {
 		if conn, err := d.dialer.DialContext(ctx, network, net.JoinHostPort(v, port)); err == nil {
diff --git a/raw_config.go b/raw_config.go
index f6789d2..4f98c3e 100644
--- a/raw_config.go
+++ b/raw_config.go
@@ -26,14 +26,17 @@ type rawConfig struct {
 			TTL     string `toml:"ttl"`
 		} `toml:"anti-replay"`
 	} `toml:"probes"`
-	PublicIP struct {
-		IPv4 string `toml:"ipv4"`
-		IPv6 string `toml:"ipv6"`
-	} `toml:"public-ip"`
-	Dialers struct {
-		Telegram string `toml:"telegram"`
-		Default  string `toml:"default"`
-	} `toml:"dialers"`
+	Network struct {
+		PublicIP struct {
+			IPv4 string `toml:"ipv4"`
+			IPv6 string `toml:"ipv6"`
+		} `toml:"public-ip"`
+		Dialers struct {
+			Telegram string `toml:"telegram"`
+			Default  string `toml:"default"`
+		} `toml:"dialers"`
+		DOHHostname string `toml:"doh-hostname"`
+	} `toml:"network"`
 	Stats struct {
 		StatsD struct {
 			Enabled      bool   `toml:"enabled"`