DHCP is the service everyone configures once and forgets until it fails, at which point forty devices hold addresses that do not work and nobody knows why. The protocol is simple; the design around it is not.
This article assumes you know the four-packet exchange from the foundations series and goes after the parts that cause outages: options, relays, scopes, and leases.
Options are the configuration
The address is the least interesting thing DHCP hands out. The options decide whether the device can use it.
| Option | Meaning | Consequence of a wrong value |
|---|---|---|
| 1 | Subnet mask | Host cannot tell local from remote |
| 3 | Default gateway | Host has an address and no way off its subnet |
| 6 | DNS servers | Names fail; everything looks broken |
| 15 | Domain name | AD joins and certificate checks misbehave |
| 42 | NTP servers | Clock drift, then Kerberos failures |
| 66/67 | TFTP server / boot file | Phones and APs never provision |
| 119 | Domain search list | Short names stop resolving |
| 150 | TFTP server addresses | Vendor-specific, often Microsoft |
| 252 | Proxy autoconfiguration | Devices bypass the proxy |
Two of these cause most of the tickets. Option 3 wrong gives you a device that can reach its neighbors and nothing else. Option 6 wrong gives you a device with working connectivity and no names, which every user reports as "the internet is down."
DHCP is how DNS policy is actually enforced
You can write perfect firewall rules and still leave filtering bypassable if option 6 hands out a public resolver. The DHCP scope is a security control in a way that few other settings are.
Relays: one server, many VLANs
DHCP Discover is a broadcast, and broadcasts stop at the router. A relay (also called an IP helper) forwards the request as unicast to the server, recording which subnet it arrived from so the server can pick the right scope.
VLAN 104 → relay 10.0.0.3 (giaddr 10.40.8.1) → server matches scope 10.40.8.0/21
Options 82 adds the switch port and circuit ID, which is how a switch can tell the server which port a request came from. It is optional, and it is how you get per-port reservations without static config.
A VLAN with a scope but no relay gets no addresses. A VLAN with a relay but no scope gets an Offer from the wrong scope, or nothing at all.
Scope design
A scope is a range inside a subnet, plus options, plus a lease time.
| Setting | Typical | Reasoning |
|---|---|---|
| Range | .10 to .250 |
Leaves room for gateways, servers, and reservations |
| Lease | 8–24 hours | Long enough to survive a day, short enough to recycle |
| Exclusions | Static device ranges | Prevents the server handing out a server's address |
| Reservations | Printers, APs, cameras | Stable addresses without static config |
| Options | Per scope | Different VLANs need different gateways and resolvers |
The pool should be sized for peak devices plus 20%. On a 1:1 campus that is roughly two leases per student: one for the device, one for a phone or a second device that appears in the afternoon.
Lease mechanics
- T1 at 50% of the lease: the client asks the server to renew, unicast.
- T2 at 87.5%: the client broadcasts for any server.
- Expiry at 100%: the address is released and the client falls back to
169.254.x.x.
Clients that were imaged together renew together. That is why an undersized pool fails in clusters at the same time every day, and why "it works in the morning" is a useful diagnostic.
Worked example: three VLANs, one server, one relay
A building with student, staff, and IoT VLANs:
| VLAN | Subnet | Scope | Relay on |
|---|---|---|---|
| 104 | 10.40.40.0/21 |
.10–.250 in each /24 |
Gateway VLAN interface |
| 106 | 10.40.60.0/22 |
.10–.250 in each /24 |
Gateway VLAN interface |
| 108 | 10.40.80.0/24 |
.10–.200 |
Gateway VLAN interface |
The server needs a scope per subnet, not per VLAN — three scopes for the /21, four for the /22. The
relay address (giaddr) is the gateway's address on that VLAN, which is how the server knows which
scope to use.
Failover, if you run two servers
| Model | How it works | Trade-off |
|---|---|---|
| Split scope | Each server owns part of the range | Simple; half the pool per server |
| Hot standby | One active, one passive, shared state | Full pool available; needs a partner relationship |
| Load balance | Both answer, percentage split | Best utilization; more complex to reason about |
Whatever you choose, the options must match. Two servers handing out different DNS servers produces devices that work or fail depending on which server answered first.
What breaks in production
- Pool exhaustion.
169.254.x.xaddresses, clustered at class change. Check the lease count before blaming the AP. - Scope on the wrong subnet. The relay points at a scope for a different VLAN; devices get addresses whose gateway is not on their wire.
- Rogue DHCP. A personal router in a wall port hands out its own scope. Devices get an address, a gateway that goes nowhere, and no internet — while the real server is healthy. DHCP snooping with an explicit trusted-port list is the fix.
- Missing relay on a new VLAN. No addresses at all, and the scope looks perfectly configured.
- Lease time too short. Devices renew constantly, the server's CPU climbs, and the logs fill with renewals.
Checklist
- Every client VLAN has a scope and a relay.
- Option 3 matches the subnet's actual gateway.
- Option 6 points at resolvers reachable from that VLAN, and at the filtered resolver for students.
- Pool size is peak devices plus 20%.
- DHCP snooping is enabled with trusted ports documented.
- Two servers, if present, hand out identical options.
Next
Scopes multiply with VLANs, and VLANs multiply with sites. Continue with IPAM and Naming That Scale to keep the address plan from becoming folklore.