DHCP and DNS: DORA, relay, records, lookups
From plug-in to web page: what each service does
DHCP gives a host its IP configuration (address, mask, default gateway, DNS servers) and DNS turns names into addresses. The decision rule for troubleshooting is short: if a host has no valid address, or an address starting with 169.254, the problem is DHCP; if it can ping by IP address but not by name, the problem is DNS. This guide follows one laptop from the moment it is plugged in until a page loads, because exams ask about each step in that order.
The scenario: a laptop joins VLAN 20, where the router is 10.20.0.1/24. The DHCP server sits on another subnet at 10.0.0.5, and the user then browses to www.example.com.
DORA: the four messages
A client without an address cannot unicast to anyone, so the first messages are broadcasts. RFC 2131 defines the exchange, and the four message names spell DORA.
| Step | Message | Sent by | How |
|---|---|---|---|
| D | DHCPDISCOVER | Client | Broadcast from 0.0.0.0, looking for any server |
| O | DHCPOFFER | Server | Offers an address and options |
| R | DHCPREQUEST | Client | Broadcast, so every server learns which offer was accepted |
| A | DHCPACK | Server | Confirms the lease |
The client uses UDP port 68 and the server UDP port 67 (IANA lists them as bootpc and bootps). A server can also answer with DHCPNAK (the request is refused, for example because the client moved to another subnet), and the client can send DHCPDECLINE if it finds the offered address already in use, or DHCPRELEASE when it gives the address back. Exams like to ask which message is the broadcast one after the offer: it is the REQUEST, not the ACK.
Relays: why the server is not on every subnet
Broadcasts do not cross a router. In the scenario the DISCOVER from VLAN 20 would die at 10.20.0.1, so the router acts as a relay agent. It receives the broadcast, writes its own interface address into the giaddr field of the message, and unicasts it to the DHCP server. The server uses giaddr to pick the matching scope, the pool of addresses for that subnet, and replies to the relay, which passes the answer on to the client. On Cisco IOS the command is ip helper-address 10.0.0.5 on the interface facing the clients.
A scope holds the address range, the mask, the exclusions (addresses you never hand out, such as the gateway), the lease duration and the options. A reservation ties a fixed address to a MAC address, so a printer keeps its address while still being configured centrally. Use a reservation, not a hand-typed static address, when the question wants the device managed from the server.
Leases and the 169.254 address
An address is leased, not given. RFC 2131 sets the defaults: the client starts renewing with the original server at T1, which is 50% of the lease, and falls back to asking any server at T2, which is 87.5%. If no server answers at all, Windows and many other systems assign themselves an APIPA address from 169.254.0.0/16. That address works only on the local link, so the symptom is “local devices reachable, nothing beyond”. If two devices answer DISCOVER with conflicting scopes, suspect a rogue DHCP server, and the usual fix is DHCP snooping on the switch.
DNS record types worth memorising
| Record | Maps | Typical question |
|---|---|---|
| A | Name to IPv4 address | Website does not resolve |
| AAAA | Name to IPv6 address (RFC 3596) | Dual-stack host |
| CNAME | Alias to another name | www pointing to a platform hostname |
| MX | Domain to mail server, with a priority | Mail delivery |
| NS | Domain to its authoritative name servers | Delegation |
| PTR | IP address to name (reverse lookup) | Logs show addresses, not names |
| SOA | Zone owner and timers | Start of a zone |
| TXT | Free text, used for SPF, DKIM and DMARC | Email authentication |
| SRV | Service location: host and port | Directory and voice services |
Two rules catch people: a CNAME cannot share its name with other record types, so it cannot sit at the zone apex, and an MX record must point to a name, not to an IP address.
The resolution path
When the laptop asks for www.example.com, the stub resolver on the host checks its own cache and the hosts file first. If neither has it, it sends a recursive query to the DNS server that DHCP supplied. That recursive resolver checks its cache, and if it has nothing, walks the hierarchy: a root server points to the .com servers, those point to the name servers for example.com, and the authoritative server for the zone returns the answer. The resolver caches it for the record’s TTL and answers the client. A recursive resolver does the lookups on behalf of its own clients (an open resolver that answers anyone is a known abuse risk); an authoritative server answers only for the zones it holds.
DNS runs on port 53. RFC 1035 limits a UDP message to 512 octets and defines TCP on the same port for larger answers; RFC 7766 later made TCP support mandatory for implementations, which is why zone transfers and big responses use TCP 53. Encrypted variants exist (DNS over TLS on TCP 853, per IANA), but the classic exam answer for plain DNS is 53.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| N10-009 | Network Operations, objective 3.4: DHCP scopes, reservations, lease time, options, relay/IP helper and exclusions; DNS record types, zone types, authoritative versus recursive, DNSSEC, DoH and DoT. APIPA sits in Networking Concepts (1.7), and nslookup and dig in Network Troubleshooting (5.5) | Networking concepts, Network troubleshooting |
| 200-301 | v1.1 (until Feb 2, 2027): IP Services, explain the role of DHCP and DNS (4.3) and configure and verify DHCP client and relay (4.6). v2.0 (from Feb 3, 2027): troubleshoot DHCPv4 client, server and relay (1.7) and diagnose problems with A, AAAA, CNAME, MX, NS and PTR records (4.4) | Network infrastructure, Network services |
| 200-901 | Network Fundamentals, objective 6.6: describe the function of DHCP and DNS among the IP services | Network fundamentals |
| AZ-802 | Implement and manage an on-premises and hybrid networking infrastructure: DNS zones and records, forwarding and conditional forwarding, hybrid name resolution and DNSSEC; the DHCP server role, scopes, reservations and DHCP high availability, on Windows Server | Networking |
| AZ-104 | DNS only: Implement and manage virtual networking, configure Azure DNS, where zones and record types apply. DHCP is not on the outline | Virtual networking |
How questions are built around it
The usual trap is the layer of failure. “Cannot browse, can ping 8.8.8.8” is DNS; “cannot ping anything, address 169.254.x.x” is DHCP; “has an address on the wrong network” is a rogue DHCP server. The constraint words are different subnet (a relay is needed), same address every time (reservation), reverse (PTR), alias (CNAME) and authoritative versus recursive. Other related topics: subnetting explains why the scope and mask must match the VLAN, IPv4 and IPv6 covers DHCPv6 and SLAAC, and the ports cheat sheet lists 53, 67 and 68 with the rest.
Question 1. Clients in VLAN 30 cannot obtain addresses. The DHCP server is in a different subnet, and clients in the server's own subnet work fine. The scope for VLAN 30 exists and is active. What is the most likely missing configuration?
- A. A longer lease duration on the scope
- B. A DHCP relay (ip helper-address) on the VLAN 30 gateway interface
- C. A CNAME record for the DHCP server
- D. A PTR record for the VLAN 30 gateway
Show answer
Answer: B
DHCPDISCOVER is a broadcast and routers do not forward broadcasts. A relay agent, configured with ip helper-address on the VLAN 30 interface, forwards the request to the server and fills in giaddr so the server selects the right scope. A longer lease, a CNAME record or a PTR record does not change whether the request reaches the server.
Question 2. A user can reach https://203.0.113.10 by IP address but typing the site's name fails. Other users resolve the name correctly. The user's address, mask and gateway are correct. What should be checked first?
- A. Replace the network adapter
- B. Release and renew the lease to get a different address
- C. Move the switch port to another VLAN
- D. The DNS server settings and resolver cache on the host
Show answer
Answer: D
Reachability by IP shows layers 1 to 4 work, and a working address and gateway rule out DHCP addressing. A name failure points to name resolution: the DNS server addresses on this host, or a stale cache. Replacing the NIC, renewing the lease for a new address or changing the switch port VLAN addresses faults that the symptoms do not show.