diff --git a/pkg/zones/machine_scan.go b/pkg/zones/machine_scan.go
index ee46203..dca0c9d 100644
--- a/pkg/zones/machine_scan.go
+++ b/pkg/zones/machine_scan.go
@@ -52,12 +52,16 @@ func (m *Machine) setID() error {
 	return nil
 }
 
-func (m *Machine) scan() error {
+func (m *Machine) scan(opts *ScanOptions) error {
 	for i := 0; i < RingsCount; i++ {
 		if err := m.tryApplyWireguardConfig(i); err != nil {
 			return err
 		}
 	}
 
-	return m.updatePublicAddresses()
+	if !opts.DontResolvePublicAddresses {
+		return m.updatePublicAddresses()
+	}
+
+	return nil
 }
diff --git a/pkg/zones/options.go b/pkg/zones/options.go
index ae47e65..4c1e806 100644
--- a/pkg/zones/options.go
+++ b/pkg/zones/options.go
@@ -12,7 +12,22 @@ import (
 type ScanOption func(*Zones, *ScanOptions) error
 
 // ScanOptions contains flags used by the initial scan
-type ScanOptions struct{}
+type ScanOptions struct {
+	// DontResolvePublicAddresses indicates we shouldn't
+	// pre-populate Machine.PublicAddresses during the
+	// initial scan
+	DontResolvePublicAddresses bool
+}
+
+// ResolvePublicAddresses instructs the scanner to use
+// the DNS resolver to get PublicAddresses of nodes.
+// Default is true
+func ResolvePublicAddresses(resolve bool) ScanOption {
+	return func(m *Zones, opt *ScanOptions) error {
+		opt.DontResolvePublicAddresses = !resolve
+		return nil
+	}
+}
 
 // WithLookuper specifies what resolver.Lookuper to use to
 // find public addresses
diff --git a/pkg/zones/scan.go b/pkg/zones/scan.go
index 2aa24d7..08734a3 100644
--- a/pkg/zones/scan.go
+++ b/pkg/zones/scan.go
@@ -46,10 +46,10 @@ func (m *Zones) scanDirectory(_ *ScanOptions) error {
 	return nil
 }
 
-func (m *Zones) scanMachines(_ *ScanOptions) error {
+func (m *Zones) scanMachines(opts *ScanOptions) error {
 	var err error
 	m.ForEachMachine(func(p *Machine) bool {
-		err = p.scan()
+		err = p.scan(opts)
 		return err != nil
 	})
 	return err