diff --git a/dnstt-client/main.go b/dnstt-client/main.go
index 3524fe1..f96b2ed 100644
--- a/dnstt-client/main.go
+++ b/dnstt-client/main.go
@@ -1,11 +1,11 @@
 // dnstt-client is the client end of a DNS tunnel.
 //
 // Usage:
-//     dnstt-client [-doh URL|-dot ADDR|-udp ADDR] -pubkey-file PUBKEYFILE DOMAIN LOCALADDR
+//     dnstt-client [-doh URL|-dot ADDR|-udp ADDR] -pubkey-file PUBKEYFILE DOMAIN
 //
 // Examples:
-//     dnstt-client -doh https://resolver.example/dns-query -pubkey-file server.pub t.example.com 127.0.0.1:7000
-//     dnstt-client -dot resolver.example:853 -pubkey-file server.pub t.example.com 127.0.0.1:7000
+//     dnstt-client -doh https://resolver.example/dns-query -pubkey-file server.pub t.example.com
+//     dnstt-client -dot resolver.example:853 -pubkey-file server.pub t.example.com
 //
 // The program supports DNS over HTTPS (DoH), DNS over TLS (DoT), and UDP DNS.
 // Use one of these options:
@@ -21,9 +21,6 @@
 // DOMAIN is the root of the DNS zone reserved for the tunnel. See README for
 // instructions on setting it up.
 //
-// LOCALADDR is the TCP address that will listen for connections and forward
-// them over the tunnel.
-//
 // In -doh and -dot modes, the program's TLS fingerprint is camouflaged with
 // uTLS by default. The specific TLS fingerprint is selected randomly from a
 // weighted distribution. You can set your own distribution (or specific single
@@ -165,8 +162,8 @@ func handle(local *net.TCPConn, sess *smux.Session, conv uint32) error {
 	return err
 }
 
-func listen(pubkey []byte, domain dns.Name, localAddr *net.TCPAddr, remoteAddr net.Addr, pconn net.PacketConn) (*pt.SocksListener, *kcp.UDPSession, *smux.Session, error) {
-	ln, err := pt.ListenSocks("tcp", localAddr.String())
+func listen(pubkey []byte, domain dns.Name, remoteAddr net.Addr, pconn net.PacketConn) (*pt.SocksListener, *kcp.UDPSession, *smux.Session, error) {
+	ln, err := pt.ListenSocks("tcp", "127.0.0.1:0")
 	if err != nil {
 		_ = pconn.Close()
 
@@ -303,11 +300,11 @@ func main() {
 
 	flag.Usage = func() {
 		_, _ = fmt.Fprintf(flag.CommandLine.Output(), `Usage:
-  %[1]s [-doh URL|-dot ADDR|-udp ADDR] -pubkey-file PUBKEYFILE DOMAIN LOCALADDR
+  %[1]s [-doh URL|-dot ADDR|-udp ADDR] -pubkey-file PUBKEYFILE DOMAIN
 
 Examples:
-  %[1]s -doh https://resolver.example/dns-query -pubkey-file server.pub t.example.com 127.0.0.1:7000
-  %[1]s -dot resolver.example:853 -pubkey-file server.pub t.example.com 127.0.0.1:7000
+  %[1]s -doh https://resolver.example/dns-query -pubkey-file server.pub t.example.com
+  %[1]s -dot resolver.example:853 -pubkey-file server.pub t.example.com
 
 `, os.Args[0])
 		flag.PrintDefaults()
@@ -345,7 +342,7 @@ Known TLS fingerprints for -utls are:
 
 	log.SetFlags(log.LstdFlags | log.LUTC)
 
-	if flag.NArg() != 2 {
+	if flag.NArg() != 1 {
 		flag.Usage()
 		os.Exit(1)
 	}
@@ -354,11 +351,6 @@ Known TLS fingerprints for -utls are:
 		_, _ = fmt.Fprintf(os.Stderr, "invalid domain %+q: %v\n", flag.Arg(0), err)
 		os.Exit(1)
 	}
-	localAddr, err := net.ResolveTCPAddr("tcp", flag.Arg(1))
-	if err != nil {
-		_, _ = fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
 
 	var pubkey []byte
 	if pubkeyFilename != "" && pubkeyString != "" {
@@ -482,7 +474,7 @@ Known TLS fingerprints for -utls are:
 		switch methodName {
 		case "dnstt":
 			pconn = NewDNSPacketConn(pconn, remoteAddr, domain)
-			ln, conn, sess, err := listen(pubkey, domain, localAddr, remoteAddr, pconn)
+			ln, conn, sess, err := listen(pubkey, domain, remoteAddr, pconn)
 			if err != nil {
 				_ = pt.CmethodError(methodName, err.Error())
 				break