DHCP and DNS

1The two services behind most faults

This is your copy to keep. The gold Going deeper boxes go past what the session covers, for anyone sitting the CompTIA Network+ exam or who wants the fuller picture.

Two services do work that nobody notices until they stop. DHCP (Dynamic Host Configuration Protocol) hands a device its addressing when it joins a network. DNS (Domain Name System) turns a name into an address so a person never has to type one.

They are worth an hour together because between them they produce a large share of faults that get reported as something else. A machine with no address is reported as a broken network port. A name that will not resolve is reported as an application being down. Neither report names the cause, and both are found in minutes once you know what each service is supposed to do.

2What DHCP hands out

A device joining a network needs four things before it can do anything, and DHCP supplies all four in one exchange. Each set of settings DHCP hands out is called a lease, because the device holds them for a fixed period rather than permanently, and the range of addresses available to hand out is called the scope.

Read the last two rows together. They are two different faults that a user describes with the same words, and the way you separate them is to ask for an address rather than a name. That is the whole reason this table is worth learning.

3How a device gets a lease

The exchange is four messages, and it has an awkward starting condition: the device has no address yet, so it cannot send to anyone in particular and has nothing to send from.

It solves that with a broadcast, a message addressed to every device on the local network at once. A port is a number that says which program on a machine the data is for, and the exchange uses two of them: 67 for the server and 68 for the client.

1. Discover. The device broadcasts "is there a DHCP server here", from port 68, with no source address of its own.
2. Offer. A server answers with an address it is willing to give, along with the mask, gateway and DNS servers.
3. Request. The device broadcasts that it is accepting that offer. It broadcasts rather than replying directly so that any other server that also made an offer hears that its offer was declined and can put that address back.
4. Acknowledge. The server confirms, and the lease starts.

Two consequences come straight out of that being a broadcast. The device does not need to be told where the server is, which is why a machine gets an address with nothing configured. And the request only reaches servers on its own VLAN, meaning its own virtual local area network, because a broadcast does not cross a router. A network whose DHCP server is somewhere else needs the router configured to pass those requests along, and when that configuration is missing the symptom is one VLAN where nothing gets an address while every other VLAN is fine.

4Leases, and what happens when one expires

A lease has a length, set on the network. The device does not wait for it to run out. It tries to renew at the halfway point, and if the server answers, the clock resets and nothing visible happens. That is why a lease can be renewed hundreds of times without anybody noticing.

If the server does not answer at the halfway point, the device keeps using the address and keeps trying. It only gives the address up when the lease actually expires, at which point it has nothing and asks again from the start.

That behavior explains a fault that otherwise makes no sense. Take a DHCP server that failed at nine in the morning on a network with an eight-hour lease. Nobody notices at nine, because every machine already has a valid lease. Nobody notices at one in the afternoon when renewals start failing, because the machines keep using what they have. What happens is that machines begin dropping off one at a time from late afternoon onwards, as each one reaches the end of its own lease, and each user reports it as their own individual problem. The lease length is the delay between the cause and the symptom.

A device that ends up with no lease and no answer gives itself an address starting 169.254. That is not a usable address, and it reaches nothing. It is a signal, and what it signals is that the machine asked and nothing answered.

5Reservations against static addresses

Some devices should always be at the same address: printers, servers, cameras, anything other machines are configured to reach by address. There are two ways to do that and they are not equally good.

The rule that follows: use a reservation wherever the device supports asking for an address at all. Keep static addresses for the equipment that has to work before any server does, which in practice means the gateway and the switches themselves.

Either way, the fixed addresses and the range DHCP hands out must not overlap. That is why a site addressing scheme divides each network into a range reserved for fixed addresses and a separate range for automatic ones.

6A second DHCP server nobody meant to install

Most consumer routers run a DHCP server and have it on by default. Plug one into a client network to use its wireless, or as a spare switch, and there are now two servers offering addresses on the same network.

Whichever answers first wins, so the damage is random. Some devices get correct addressing from the real server. Others get an address from a different range entirely, with a gateway pointing at a device that cannot route anywhere. The symptom is a site where some machines work and some do not, with no pattern, changing every time a machine reconnects.

Two things find it. The first is reading the addressing on a machine that is failing: ipconfig /all names the server that answered, and if that address is not the one in the documentation, you have both the cause and the address of the offending device. The second is the switch, which can be told to accept DHCP offers from one address only and to block the rest, a setting the vendor calls DHCP Guarding. It needs the trusted server's address, and it requires the site's switches to be managed.

7What DNS does

DNS turns a name into an address. Nothing on the network routes on names, so this has to happen before any connection is made, which is why a DNS fault stops everything while the network underneath is healthy.

A Windows machine answers a name in a fixed order, and it stops at the first answer it gets.

1. Its own cache. Answers it received recently are held in memory. No traffic leaves the machine.
2. The hosts file. A local text file of name-to-address entries, normally empty. Anything in it overrides everything below.
3. Its configured DNS server, the one DHCP handed it. At a site with its own server, that is the internal one, which knows the internal names.
4. That server's forwarders. For a name it does not hold, the internal server asks a public resolver and passes the answer back.

The order is the diagnosis. A name that resolves on one machine and not another points at step 1 or 2 on the failing machine. A name that fails everywhere internally points at step 3. An internal name that resolves and a public one that does not points at step 4.

8The record types, and why a change takes a while to land

Every record carries a TTL (time to live), a number of seconds saying how long anyone may keep the answer before asking again. It is the reason a change does not take effect immediately: everything that already asked is entitled to keep using the old answer until its copy expires.

Work an example. A record with a TTL of 3,600 seconds is one hour. Change the address at noon and a machine that looked it up at 11:55 keeps the old answer until 12:55. During that hour, the record is genuinely correct at the source and genuinely wrong on that machine, and both are true at once. This is why a planned change gets its TTL lowered the day before, so the window is minutes rather than hours.

On the machine in front of you, ipconfig /flushdns clears the local cache and forces a fresh lookup. That fixes the one machine you are sitting at and nothing else, which is worth being clear about before reporting a problem as solved.

9The four faults you will actually see

10Practice on your own machine

1. Run ipconfig /all. Write down your address, mask, gateway, DNS servers, the DHCP server that answered, and your lease start and end times.
2. Work out your lease length from the start and end times, and say when your machine will next try to renew.
3. Run nslookup against an internal name and a public one. Note which server answered each and whether the answer is marked as coming from a cache.
4. Run ipconfig /displaydns and find an entry with a TTL counting down. Run it again a minute later and confirm the number has fallen.
5. In the UniFi console, open a network's settings and find its address range, its lease time and the DNS servers it hands out. Confirm they match what your machine received.
6. Find a device with a reservation in the console. Note its hardware address and the address reserved for it, and confirm that address sits outside the automatic range.

11Check for understanding

1. Name the four settings a device receives in a lease, and say what specifically breaks if the gateway is missing but the other three are correct.

2. Why does a device broadcast its acceptance of an offer rather than replying directly to the server that made it?

3. A DHCP server fails at nine in the morning on a network with an eight-hour lease. Describe what the day looks like from the service desk, and why.

4. A printer needs a permanent address. Give the reason a reservation is better than typing an address into the printer, and name the one category of device that should still have an address typed in.

5. A user can reach a file server by its IP address but not by its name. Everyone else can reach it by name. Where do you look, in what order, and why is the order what it is?

6. A record's address was changed at noon and the TTL is 3,600 seconds. A machine says the old address at 12:30. Is something broken? What would you do, and what would that fix?

7. A laptop browses the internet perfectly but cannot sign in to the domain, reach file shares, or pick up policy. Its DNS server is set to a public resolver. Explain why the internet works and the rest does not.

12Before the next session

• Do the practice steps in section 10 and bring your lease length and renewal time worked out.
• Be able to say the four-message exchange in order and what each message does.
• Read the Network+ companion, chapter 2, common protocols and ports, and chapter 11, the DHCP and name resolution sections.

Next session. 06 - Firewalls and NAT, meaning network address translation. What a firewall decides and in what order, why a reply gets back in without a rule, and what translation does to a packet.

13Glossary

DHCP

Dynamic Host Configuration Protocol. Hands a device its address, mask, gateway and DNS servers when it joins a network.

Lease

A set of DHCP settings granted for a fixed period rather than permanently.

Scope

The range of addresses a DHCP server may hand out on a network.

Reservation

An entry on the DHCP server pairing one hardware address with one IP address, so that device always gets the same one.

Static address

An address typed into the device itself, with the network unaware of it.

Broadcast

A message addressed to every device on the local network at once. It does not cross a router.

Port

A number saying which program on a machine the data is for. DHCP uses 67 for the server and 68 for the client.

DHCP Guarding

A switch setting that accepts DHCP offers only from a named address and blocks the rest.

APIPA

The 169.254 address a machine gives itself when it asked for a lease and nothing answered.

DNS

Domain Name System. Turns a name into an address.

Resolver

The server a machine asks to turn a name into an address.

Forwarder

The server an internal DNS server asks for names it does not hold itself.

Hosts file

A local text file of name-to-address entries that overrides every other source on that machine.

TTL

Time to live. The number of seconds an answer may be kept before it must be asked for again.

A record

A name and its IPv4 address.

CNAME

A name that points at another name.

MX record

The record saying where mail for a domain is delivered.

PTR record

An address and the name it belongs to. The reverse of an A record.

SRV record

A record naming which server provides a service and on which port. How a domain-joined machine finds its domain controllers.

14Sources

• Internet Engineering Task Force, RFC 2131, Dynamic Host Configuration Protocol, for the four-message exchange, leases and renewal at the halfway point.
• Internet Engineering Task Force, RFC 1035, Domain Names, Implementation and Specification, for record types and time to live.
• Internet Engineering Task Force, RFC 3927, Dynamic Configuration of IPv4 Link-Local Addresses, for the 169.254 range.
• Ubiquiti, UniFi DHCP Server, for what the server supplies and where it is enabled.
• Ubiquiti, Duplicate IP Addresses and Rogue DHCP Servers, for DHCP Guarding and its requirement for managed switches.
• Ubiquiti, UniFi DNS Troubleshooting Guide.
• Microsoft Learn, DNS troubleshooting guidance, for client resolution behavior on Windows.
• Kodi A. Cochran, CompTIA Network+ (N10-009) Certification Companion (Apress, 2026), chapter 2 and chapter 11.