DHCP and dynamic address assignment
Why this matters
Objective 3.4 is "given a scenario, implement IPv4 and IPv6 network services", and DHCP is the one that breaks most visibly. When it fails, users do not get a degraded service — they get an APIPA address and no network at all.
Every configuration element here is also a failure mode, which is why they are worth learning as pairs: a scope that is exhausted, a lease that is too long, a missing relay, an exclusion that was never set. This lesson also covers the protocols that secure DNS in transit, which sit in the same objective.
The lesson
Dynamic addressing, and the DORA exchange
Dynamic addressing means a host is given its configuration by a server rather than having it typed in. The alternative, static addressing, is correct for infrastructure — servers, printers, switches, anything whose address other things depend on — and unmanageable for end users at any scale.
DHCP performs the assignment in four steps, remembered as DORA:
- Discover. The client has no address, so it broadcasts to find a server.
- Offer. A server responds with an available address and configuration.
- Request. The client formally requests that offer — broadcast, so that any other servers that also offered know their offer was declined.
- Acknowledge. The server confirms, and the lease begins.
DHCP runs over UDP ports 67 (server) and 68 (client). It must be UDP and it must broadcast, because the client has no address yet and therefore cannot establish a connection or be addressed directly.
Scope, exclusions and reservations
Three related settings that are easy to confuse, and the exam relies on that.
A scope is the range of addresses a server may hand out on a given subnet, together with the other settings that go with it. 192.168.1.100 to 192.168.1.200 is a scope.
An exclusion is a range inside the scope that the server must not assign. You define a scope of .100 to .200 and exclude .150 to .160 because those are used by devices configured statically. Without the exclusion, the server will eventually hand one of those addresses to a laptop, and then two devices claim the same address.
A reservation ties a specific address to a specific MAC address. The device still uses DHCP — it asks, and it is always answered with the same address.
The distinction the exam wants: a reservation gives a device a consistent address while keeping it centrally managed; a static configuration typed into the device does not. Reservations are better for printers, cameras and access points precisely because the address can be changed from one place, and because the device still receives DNS and gateway settings from the scope.
Address conflict is what happens when these are set up wrongly: a statically configured device inside the scope with no matching exclusion. The symptom is intermittent connectivity for one or both devices, which is a favourite scenario.
Lease time
The lease is how long a client may keep its address before renewing. A client attempts renewal at 50% of the lease (T1), and if that fails it tries any server at 87.5% (T2).
Choosing a lease time is a real trade:
- Short leases return addresses to the pool quickly, which suits guest networks and conference spaces where devices come and go. The cost is more DHCP traffic and more dependence on the server being available.
- Long leases reduce traffic and keep clients working through a server outage, but addresses stay allocated long after devices have left — so a pool can exhaust even though few devices are actually present.
The exam scenario is usually a guest or wireless network where the pool empties over a day. The answer is to shorten the lease, not to enlarge the scope.
Options
DHCP options are the extra settings delivered alongside the address. The common ones:
- Option 3 — default gateway
- Option 6 — DNS servers
- Option 15 — DNS domain name
- Option 42 — NTP servers
- Option 66/150 — TFTP server or boot server, used by IP phones and by PXE booting
Options are why a DHCP failure is rarely just an address problem: a client with an address but no option 6 has no DNS, which presents as "the internet is down" while ping by IP works perfectly.
Relay and IP helper
DHCP Discover is a broadcast, and routers do not forward broadcasts. So a client on one subnet cannot reach a DHCP server on another — which is a problem, because almost nobody runs a DHCP server per VLAN.
A DHCP relay — configured on the router or SVI with an IP helper address — solves it. The relay receives the broadcast, converts it to a unicast addressed to the DHCP server, and adds the receiving interface's address so the server knows which scope to answer from. Replies come back through the relay to the client.
This is one of the most reliable troubleshooting questions on the exam. A new VLAN where clients get APIPA addresses while an existing VLAN works fine is a missing IP helper, nearly every time.
Securing DNS: DNSSEC, DoH and DoT
Objective 3.4 groups these with address services because they are all part of implementing network services correctly. They solve two different problems, and confusing them is the trap.
DNSSEC (DNS Security Extensions) provides authenticity and integrity. It signs DNS records cryptographically so a resolver can verify that an answer genuinely came from the authoritative zone and was not altered in transit. It defends against cache poisoning and spoofed answers.
What DNSSEC does not do is encrypt. Records are signed, not hidden — anyone watching still sees which names you looked up.
DoH (DNS over HTTPS) and DoT (DNS over TLS) provide confidentiality. They encrypt the query so an observer cannot read it.
- DoT runs on its own port, 853, so it is identifiable on the network and can be permitted or blocked deliberately.
- DoH runs over 443, indistinguishable from ordinary web traffic.
That difference is the examinable one, and it cuts both ways. DoH is harder for a censor or an attacker to block — and equally harder for an enterprise to control, because a browser using DoH bypasses the organisation's DNS filtering entirely while looking exactly like HTTPS. Many organisations therefore prefer DoT internally, or disable DoH in managed browsers.
The summary worth memorising: DNSSEC proves the answer is genuine; DoH and DoT stop anyone reading the question. They are complementary, not alternatives.
Record types, in outline
DHCP hands clients the address of a DNS server; what that server returns is the subject of the next lesson. The record types named in this objective — A, AAAA, CNAME, MX, TXT, NS and PTR — are covered there and in the lesson after it.
Practise what you just read
1. What is the correct order of the four messages in a DHCP address assignment?
Select one
Show answer
A. Remembered as DORA. The client broadcasts a Discover, a server makes an Offer, the client broadcasts a Request for that offer so other servers know theirs was declined, and the server sends an Acknowledge that begins the lease.
2. Why must the initial DHCP exchange use UDP and a broadcast rather than a connection to the server?
Select one
Show answer
B. A client starting DHCP has no IP address, so it cannot establish a TCP connection or be addressed directly. It broadcasts instead, using UDP ports 67 for the server and 68 for the client, which is the only way to reach a server it cannot yet address.
3. Why is a DHCP reservation preferable to typing a static address into a networked printer?
Select one
Show answer
C. A reservation ties a specific address to a specific MAC address, so the device still uses DHCP and is always answered with the same address. The address can be changed from one place, and the device still receives DNS and gateway settings from the scope.
8 more questions on this objective are part of the full course.
Hands-on labs
Part of the free CompTIA Network+ N10-009 course — 44 lessons and 74 hands-on labs.