What Is DHCP relay in Networking?
This page mentions older exam versions. See the Current Exam Context and Legacy Exam Context sections below for the updated mapping.
On This Page
What do you want to do?
Quick Definition
When a device asks for an IP address using DHCP, that request is normally sent as a broadcast that does not cross a router. A DHCP relay takes that broadcast request and sends it as a unicast message to a DHCP server located on a different network. The server then sends back the IP address information through the relay to the requesting device.
Commonly Confused With
DHCP snooping is a security feature that validates DHCP messages and builds a binding table to prevent rogue servers from assigning addresses. DHCP relay is about forwarding messages across subnets. Snooping does not forward requests; it filters or inspects them. They operate at different layers and serve different purposes.
DHCP snooping is like a bouncer checking IDs at the door, while DHCP relay is like a courier delivering mail between different buildings.
DNS relay forwards DNS queries from clients to a DNS server, but it does not deal with IP address assignment. DNS relay works with UDP port 53, while DHCP relay uses port 67/68. Also, DNS queries are typically unicast, so DNS relay is less about overcoming broadcast limitations and more about caching or resolving names centrally.
DHCP relay gives you a home address (IP address), while DNS relay gives you directions to a friend's house (domain to IP mapping).
DHCP is built on BOOTP, and the relay mechanisms are similar. The main difference is that DHCP supports many more options and dynamic address allocation, while BOOTP only provides static assignments. In practice, DHCP relay is backward compatible with BOOTP, but the two are distinct protocols. Modern networking uses DHCP relay far more than BOOTP relay.
BOOTP is like a simple food menu that never changes, while DHCP is a dynamic menu that can adjust based on the time of day and customer preferences.
NAT changes the source or destination IP address in packets to allow private IP addresses to communicate with public networks. DHCP relay does not change the actual IP addresses of the client or server; it only forwards messages and inserts a field (giaddr) for subnet identification. NAT happens at Layer 3 while DHCP relay works at the application layer (UDP).
NAT is like a translator changing languages between people, while DHCP relay is like a messenger who carries the same message in the same language but uses a different route.
DHCP relay appears directly in 27exam-style practice questions in Courseiva's question bank — one of the most-tested concepts on Cisco CCNA. Practise them →
Must Know for Exams
DHCP relay is a specific topic that appears in multiple certification exams, each with a different emphasis. On the CompTIA Network+ (N10-008 or later), DHCP relay is part of Objective 1.6: Explain the purpose of network services. The exam expects you to know that DHCP relay allows clients to obtain an IP address from a DHCP server on a different subnet. You might see a multiple-choice question asking, 'Which device forwards DHCP requests across subnets?' with options like router, switch, bridge, and firewall. The correct answer is a router configured as a DHCP relay. You should also understand the basic flow: client broadcast, relay unicast to server, server unicast to relay, relay broadcast to client.
On the Cisco CCNA (200-301), DHCP relay is covered under the 'IP Services' section. You will need to configure an interface to act as a relay using the 'ip helper-address <server-ip>' command. The exam may present a scenario where a client on VLAN 10 cannot get an IP, and you must identify that the router interface for VLAN 10 lacks the helper-address. They might ask about adding multiple helper addresses for redundancy. There is also a strong focus on the giaddr field, questions can ask, 'What information does a DHCP relay add to the packet to inform the server of the client's subnet?' You must select giaddr. Transcribing the command output is also common: show ip dhcp relay information option might display relay agent information.
For the CompTIA Security+ (SY0-601 or SY0-701), DHCP relay appears in the context of network security. You do not need to configure it, but you need to understand how DHCP relay works to see why DHCP snooping and Dynamic ARP Inspection are needed. A DHCP relay might be exploited to perform a DHCP starvation attack if not properly secured. You may see questions about the DHCP Relay Agent Information Option (Option 82) as a way to provide more granular security for IP assignment.
On the Microsoft Azure AZ-104, DHCP relay appears in the context of hybrid networking. When you connect an on-premises network to Azure via a VPN or ExpressRoute, you may need to configure Azure to support a DHCP relay so that VMs in Azure can get IP addresses from your on-premises DHCP server. The exam may ask about the custom DHCP options in Azure VNet or about how Azure routes DHCP requests across the gateway. While not a primary objective, it is a supporting concept for many hybrid scenarios.
For AWS SAA and Google ACE, DHCP relay is not a primary objective but it appears in the context of DHCP option sets and custom resolvers. In AWS, you can set up a DHCP option set that points to an on-premises DNS server, but the actual DHCP relay is handled by the VPC infrastructure. Knowing how broadcast domains work in VPCs helps you understand why you cannot use a custom DHCP server in a VPC without using a relay. For all these exams, the takeaway is that DHCP relay is the bridge that allows a single DHCP server to serve multiple subnets, which is critical for efficient network design.
Simple Meaning
Imagine you live in a large apartment building, and there is one main mailbox area where all packages are delivered. If you want to receive a package, you cannot walk into the main office and wait there because the building has many floors and wings. Instead, you tell your building's concierge that you are expecting a package. The concierge calls the main office, gets your package, and brings it back to you. In this analogy, you are the device that needs an IP address, the building is your local subnet, the concierge is the DHCP relay agent, and the main office is the DHCP server located on a different subnet.
In a computer network, when a device first connects, it sends out a DHCP discover message. That message is a broadcast, which means every device on the same local network hears it. Routers normally stop broadcasts from crossing into other networks. If your DHCP server is on a different subnet, the server will never hear the request without something to forward it. That something is a DHCP relay. The relay agent listens for DHCP broadcast messages on the client's subnet, then wraps those messages into a unicast packet addressed directly to the known DHCP server. The server processes the request and sends a unicast reply back to the relay agent. The relay then sends that reply as a broadcast back to the client on the local subnet. This way, one central DHCP server can serve many different subnets without you needing to install a separate DHCP server on each one.
People often confuse DHCP relay with DHCP snooping or DNS relay. DHCP relay is simply about message forwarding. DHCP snooping is a security feature that verifies DHCP messages before forwarding. DNS relay helps with domain name resolution, not IP address assignment. DHCP relay is a crucial part of network design because it allows network administrators to manage IP addresses from a single server, reducing maintenance and ensuring consistent settings across the entire organization.
Full Technical Definition
DHCP relay, formally defined in RFC 2131 and refined in RFC 3046 (DHCP Relay Agent Information Option, also known as Option 82), is a networking function that enables a DHCP client on one IP subnet to obtain configuration parameters from a DHCP server located on a different subnet. The fundamental problem that DHCP relay solves originates from the nature of the DHCP protocol itself. DHCP is based on the earlier BOOTP protocol and uses UDP ports 67 (server) and 68 (client). A DHCP client begins the address acquisition process by sending a DHCPDISCOVER message with a destination IP address of 255.255.255.255 (limited broadcast) and a source IP address of 0.0.0.0 (since the client does not yet have an IP address). By design, routers do not forward broadcast packets across subnet boundaries. Without a relay agent, a DHCP server that is not on the same broadcast domain as the client would never receive the client's request.
The DHCP relay agent is typically implemented on a router, a Layer 3 switch, or a dedicated network appliance. When the relay agent receives a DHCP broadcast on an interface, it examines the packet and performs several modifications. It changes the destination IP address from the broadcast address to the unicast address of the configured DHCP server. The relay agent sets the source IP address to the IP address of its own interface that connects to the server's network. It also sets the gateway IP address (giaddr) field in the DHCP message to the IP address of the relay agent's interface that received the client's broadcast. This giaddr field is critical because the DHCP server uses it to determine which subnet the client belongs to and which IP address pool to assign an address from. After these modifications, the relay agent sends the message as a unicast to the server.
When the DHCP server responds with a DHCPOFFER, DHCPACK, or DHCPNAK message, it sends the response as a unicast to the relay agent based on the giaddr field. The relay agent then strips the modifications, changes the destination IP back to the broadcast address (255.255.255.255) for the client's subnet, and forwards the response out the appropriate interface. The client receives this broadcast and processes it as if the server were directly on its subnet. Optionally, the relay agent can insert the DHCP Relay Agent Information Option (Option 82) into the message to provide additional details such as circuit ID or remote ID. This information can help the server apply more granular policies, such as assigning specific IP addresses based on which port or cable modem a client is connected through.
In modern networks, DHCP relay is essential for efficient IP address management. It allows organizations to centralize DHCP servers, simplifying administration and ensuring consistency of options like DNS servers, domain names, and lease times across all subnets. The relay agent itself must be configured with the IP address of one or more DHCP servers. It is also common to configure multiple relay destinations to provide redundancy. Some implementations support DHCP relay using a global address or a VLAN interface. The relay agent does not need to be the default gateway for the client, but it must be on the same broadcast domain as the client. In IPv6 networks, a similar function called DHCPv6 relay exists, though DHCPv6 often relies on multicast rather than broadcast.
Understanding DHCP relay is important for passing certification exams like the CCNA, Network+, and Azure AZ-104. In these exams, you may be asked to identify the role of the giaddr field, configure a relay agent on a router, or troubleshoot why clients on a remote subnet are not receiving IP addresses. The technology is stable and well-documented, but misconfiguration of the relay destination address or ACLs blocking UDP ports 67 and 68 between relay and server are common issues. Also, some older or misconfigured network devices may drop DHCP packets due to security features like DHCP snooping or IP source guard, which can interfere with relay operation.
Real-Life Example
Think about a large corporate campus with several buildings, each building having its own floor with many offices. The company wants to give every employee a badge that grants access to the building and specific rooms. Instead of having a separate security office in every building to print and hand out badges, the company sets up one central HR office on the main floor of the main building. However, the employees work in different buildings. How does an employee in Building B get their badge? They cannot go to the main building every morning, and the security system in Building B does not know about badges from the central office. So the company installs a small kiosk in the lobby of each building. When an employee arrives at Building B, they swipe their ID card at the kiosk. The kiosk sends a message to the central HR office saying, 'I have a person here, they need a badge for Building B.' The central office looks up the person's details, determines they work in Building B, and sends back the badge information. The kiosk prints the badge and gives it to the employee. In this story, the employee is the DHCP client, the kiosk is the DHCP relay agent, and the central HR office is the DHCP server.
Now, why does this matter? Because without the kiosk, the employee would have to travel to the main building every time, which is a waste of time. Similarly, without a DHCP relay, every subnet would need its own DHCP server, which increases hardware costs and administrative overhead. The kiosk is not the boss that decides the badge level, it simply forwards the request. The relay does not assign IP addresses; it just passes messages back and forth. The kiosk also remembers which building it is in, so the central office knows which building's badge settings to apply. The relay agent uses the giaddr field to tell the server which subnet the client is on.
Another everyday analogy is a telephone switchboard. In the old days, when you wanted to call someone in another city, you could not dial them directly because your telephone was only connected to a local exchange. You would pick up the phone, and the operator (the relay) would ask who you wanted to call. The operator would then call the distant telephone exchange and patch you through. The operator would also tell the far exchange where you were calling from, so the billing system would work correctly. The DHCP relay works the same way: it takes a broadcast 'call' from a device, asks the DHCP server (the distant exchange) to assign an address, and then patches the response back to the device.
Why This Term Matters
DHCP relay matters because it allows network designers to centralize IP address management while supporting a flat network topology. In any organization larger than a small home network, you will have multiple subnets or VLANs. Without DHCP relay, you would be forced to place a DHCP server on every subnet, which increases cost, complicates configuration, and makes it harder to enforce consistent network policies. A single DHCP server can serve hundreds of subnets if relay agents are properly configured on routers or Layer 3 switches. This centralization simplifies updates, backups, and monitoring. For example, if you need to change the DNS server address for all devices, you only need to change it once on the central DHCP server instead of on each subnet's server.
From a troubleshooting perspective, understanding DHCP relay is essential because many IP address assignment failures are caused by relay issues rather than server problems. A client may send a DHCP discover, and the relay may receive it, but if the relay cannot reach the server due to a firewall or routing issue, the client will end up with a link-local address (169.254.x.x on Windows). Knowing how to check the relay configuration, verify connectivity on UDP 67/68, and inspect the giaddr field can save hours of debugging time.
In the context of certification exams, DHCP relay appears frequently. On the CCNA, you may configure an interface as a DHCP relay using the 'ip helper-address' command. On the Network+, you need to understand the concept and know that a client on one subnet can get an IP from a server on another subnet through a relay agent. For cloud exams like AWS SAA and Google ACE, DHCP relay concepts appear in VPC and hybrid network scenarios, where on-premises DHCP servers must serve cloud-based subnets through a VPN. Security professionals also need to know about relay because misconfigured relays can be exploited to leak information or cause address exhaustion. Overall, DHCP relay is a foundational networking concept that every IT professional should understand.
How It Appears in Exam Questions
DHCP relay questions appear in several patterns across certifications. The most common pattern is a scenario question: 'A network administrator has a DHCP server located on subnet 192.168.10.0/24. Clients on subnet 192.168.20.0/24 are unable to obtain IP addresses. The router connecting the subnets has the IP address 192.168.10.1 on the server side and 192.168.20.1 on the client side. What is the most likely cause?' The answer might be that the router interface on the client side is not configured with 'ip helper-address 192.168.10.1' (on Cisco) or that no relay agent is configured. This question tests whether you understand the need for a relay agent.
Another pattern involves troubleshooting output. For example, a question might show the output of 'debug ip dhcp server packet' on a Cisco router, and you see that the server receives a DHCPDISCOVER from a relay with giaddr set to 0.0.0.0. This indicates the relay is not inserting the correct gateway address, so the server cannot determine which subnet to assign an address to. You must then recognize that the relay agent's interface is misconfigured or that the relay feature is not enabled.
Configuration questions are also common. 'Which command configures a DHCP relay on a Cisco router?' The correct answer is 'ip helper-address <server-ip>' under interface configuration mode. Alternatively, they might ask about the 'ip dhcp relay' command in other vendor contexts. For cloud exams, a question might read: 'You are connecting an on-premises network to AWS using a VPN. Your on-premises DHCP server should assign IP addresses to instances in an AWS VPC. What must you configure?' The answer involves setting up a DHCP relay in the VPC or using a custom DHCP option set with the appropriate relay IP.
Multiple-choice questions often present a list of networking services: DNS, DHCP, FTP, and DHCP relay, asking which service forwards broadcasts. Sometimes they combine DHCP relay with the concept of BOOTP forwarding. 'A network device has the ability to forward BOOTP requests. Which service does this support?' The answer is DHCP relay. Questions about the DHCP Relay Agent Information Option (Option 82) appear in security-focused exams, asking how the relay can inform the server about the client's port or switch location.
Finally, there are design questions: 'A company has 50 VLANs. To minimize server management, the administrator wants to use a single DHCP server. What feature should be enabled on the Layer 3 switch?' The obvious answer is DHCP relay. These questions test not just the definition but the practical application of the technology in real networks.
Practise DHCP relay Questions
Test your understanding with exam-style practice questions.
Example Scenario
You are the network administrator for a company called GreenTech. The company has two floors in an office building. On floor 1, there is an engineering department with its own network, subnet 192.168.10.0/24. On floor 2, there is a sales department on subnet 192.168.20.0/24. Both floors are connected by a router. The company has a central DHCP server located on the IT server room, which is also on subnet 192.168.10.0/24. The DHCP server is configured with two address pools: one for 192.168.10.0/24 and one for 192.168.20.0/24. The router has the IP address 192.168.10.1 on its interface connected to floor 1 and 192.168.20.1 on its interface connected to floor 2.
One morning, an employee on floor 2 plugs in a new laptop. The laptop sends a DHCPDISCOVER broadcast to the entire floor 2 network. The request reaches the router's floor 2 interface, but the router is not configured to forward DHCP broadcasts. The DHCP server on floor 1 never receives the request. The laptop tries a few times and eventually assigns itself an Automatic Private IP Address (APIPA) in the 169.254.x.x range, which does not allow it to access the internet or internal resources.
To fix this, you log into the router and go to the interface configuration for the floor 2 side (interface GigabitEthernet0/1). You enter the command 'ip helper-address 192.168.10.100' where 192.168.10.100 is the IP address of the DHCP server. You also need to ensure the router is allowed to forward UDP broadcasts for DHCP; on Cisco devices, 'ip forward-protocol udp 67' may be needed (though helper-address often enables this automatically). Now, when the same laptop sends a DHCPDISCOVER, the router receives the broadcast, changes it to a unicast packet with the DHCP server's IP as the destination, sets the giaddr field to 192.168.20.1 so the server knows the client is on subnet 192.168.20.0/24, and forwards it to the server. The server then sends a DHCPOFFER back to the router, which broadcasts it to the laptop. The laptop receives an IP address, in this case 192.168.20.50, and can now access the network properly. This simple fix saves the company from buying a second DHCP server for floor 2.
Common Mistakes
Thinking a DHCP relay is the same as a DHCP server.
A DHCP relay is a forwarding agent that passes messages between client and server. It does not assign IP addresses or manage lease databases. The server does all the leasing and configuration. Confusing them leads to thinking you need to configure address pools on the relay, which is incorrect.
Remember: the relay is just a postman, it delivers the request and the response, but does not decide what address to give.
Assuming a router automatically forwards DHCP broadcasts without configuration.
By default, routers do not forward any broadcast packets, including DHCP. You must explicitly enable DHCP relay on the router's interface facing the clients. If you forget this step, clients on remote subnets will never reach the DHCP server.
Always configure the 'ip helper-address' (or equivalent) on the client-facing interface of the router or Layer 3 switch.
Setting the helper-address to the wrong interface.
The helper-address command must be applied to the interface that receives the client's broadcast. If you apply it to the server-facing interface, the relay will not receive the client broadcasts at all, so nothing will be forwarded.
Apply the helper-address on each interface that connects to a subnet with DHCP clients that need to reach the server.
Thinking the DHCP relay needs to be on the same subnet as the DHCP server.
The relay agent only needs IP reachability to the DHCP server. The relay can be located anywhere in the network as long as the two can communicate via unicast. The relay is typically on the router that connects the client's subnet, and that router may be far from the server.
As long as the relay can send unicast UDP packets to the server's IP address on port 67, it will work. Routing between relay and server is required.
Forgetting to include the giaddr field in understanding the DHCP flow.
The giaddr (gateway IP address) field is what tells the DHCP server which subnet the client belongs to. Without it, the server would not know which address pool to use. Many beginners think the server just sends an offer to any available address, but without giaddr, the server might assign an IP from the wrong subnet.
Always remember that the relay sets giaddr to its own IP address on the client's subnet. The server uses this to select the correct scope.
Thinking only routers can be DHCP relay agents.
While routers are common, many Layer 3 switches, firewall appliances, and even some wireless controllers can act as DHCP relay agents. Even a Linux server with appropriate configuration can be a relay using tools like dhcrelay. The relay function is not tied to a specific device type.
Any device that can intercept Layer 2 broadcasts and forward them as Layer 3 unicasts can serve as a DHCP relay agent.
Exam Trap — Don't Get Fooled
{"trap":"A question states: 'A client on a remote subnet is unable to obtain an IP address. You check the DHCP server and see that it is online and reachable. The client's subnet is configured with an address pool.
What is the most likely issue?' The trap answer is 'The DHCP server is not configured with a scope for that subnet,' but the real issue could be that the router interface facing the client does not have the helper-address configured.","why_learners_choose_it":"Learners tend to think of the problem as a server configuration issue because they are focused on the server side.
They assume the server automatically serves all subnets if the pool exists. They overlook the broadcast barrier and the necessity of a relay agent.","how_to_avoid_it":"Always reason from the client's perspective.
The client sends a broadcast. Where does that broadcast go? It only reaches devices on the same subnet. Ask yourself: is there a device that forwards broadcasts to the server? If not, no amount of server configuration will help.
The first step in troubleshooting DHCP is to confirm that a relay agent is in place."
Step-by-Step Breakdown
Client sends DHCPDISCOVER broadcast
When a device connects to a network, it does not have an IP address yet. It sends a DHCPDISCOVER message with destination IP 255.255.255.255 (broadcast) and source IP 0.0.0.0. This message reaches every device on the same local subnet, including the router or Layer 3 switch if it is connected.
Relay agent receives the broadcast on its client-facing interface
The DHCP relay agent (usually a router) has an interface configured to listen for DHCP broadcasts. When it receives the DHCPDISCOVER, it does not discard it like a normal broadcast. Instead, the relay feature intercepts the UDP packet on port 67 and prepares to forward it.
Relay agent modifies the DHCP message
The relay agent changes the source IP address of the packet to the IP address of its own interface on the client's subnet. It also sets the gateway IP address (giaddr) field in the DHCP message to the same IP address. This giaddr tells the server which subnet the client is from. The destination IP is changed from the broadcast address to the unicast IP of the DHCP server.
Relay agent forwards the message as a unicast to the DHCP server
The relay agent sends the modified DHCPDISCOVER as a standard unicast IP packet to the configured DHCP server IP address, using UDP port 67. This packet can now cross routers because it is a unicast, not a broadcast. The server receives the request just like any other unicast traffic.
DHCP server processes the request using the giaddr field
The DHCP server looks at the giaddr to determine which subnet the client is on. It then selects an IP address from the appropriate address pool (scope) for that subnet. The server also checks any configured options or reservations. It creates a DHCPOFFER (or DHCPACK later) and sets the destination IP to the relay agent's IP address as given by the source IP of the received packet.
Server sends a unicast response back to the relay agent
The server sends the DHCPOFFER as a unicast packet to the relay agent's IP address. The relay agent is the only device that can properly handle this response because it knows the original client. The server does not know the client's IP because the client does not have one yet.
Relay agent receives the response and broadcasts it to the client's subnet
The relay agent takes the DHCPOFFER (or DHCPACK) from the server, reverts the modifications, and sets the destination MAC address to a broadcast MAC (ff:ff:ff:ff:ff:ff) and the destination IP to 255.255.255.255. It then sends this broadcast out the same interface that originally received the client's DHCPDISCOVER. The client hears the broadcast and processes it.
Client accepts the offer and sends DHCPREQUEST (optionally relayed again)
The client sends a DHCPREQUEST broadcast to formally request the offered IP address. This broadcast is also received and relayed by the relay agent to the server. The server then sends a DHCPACK (or DHCPNAK) through the relay to confirm the lease. This step ensures the server knows the client accepted the offer.
Lease is established and client uses the IP address
After receiving the DHCPACK, the client configures its network interface with the assigned IP address, subnet mask, default gateway, and other options like DNS servers. The client can now communicate on the network. The relay agent may continue to relay renewal messages (DHCPREQUEST) when the lease is about to expire.
Practical Mini-Lesson
In real-world networks, the configuration of DHCP relay is straightforward but requires attention to three main elements: the relay agent's interface, the destination server IP, and the network connectivity between them. On a Cisco router, the command is 'interface <type> <number>' then 'ip helper-address <dhcp-server-ip>'. The relay agent can be configured with multiple helper-address commands for redundancy, so if the first server does not respond, the relay will try the second. On a Layer 3 switch, the configuration is identical for a routed interface. For an SVI (Switch Virtual Interface), you apply the helper-address under the VLAN interface. For example, if you have VLAN 10 with clients, you configure 'interface vlan 10' and then 'ip helper-address 192.168.1.10'. You want to ensure that only DHCP packets are forwarded, but by default the helper-address forwards multiple UDP services like TFTP, DNS, and others. You can restrict this using the 'ip forward-protocol' commands or using ACLs to filter which UDP ports are relayed.
In a multi-vendor environment, the configuration syntax differs. For example, on a Juniper device, you configure 'set forwarding-options dhcp-relay server-group main-server 192.168.1.10' and 'set forwarding-options dhcp-relay group client-group interface ge-0/0/1.0'. On a Linux server, the dhcrelay command can be used: 'dhcrelay -i eth0 -i eth1 192.168.1.10'. Firewall rules between the relay and the server must permit inbound UDP on port 67 from the relay's source IP. Also, any ACLs on the relay itself that inspect traffic must allow DHCP packets to be relayed. Many unintentional DHCP failures are caused by ACLs that block UDP 67 or 68.
What can go wrong? The relay agent's interface might be misconfigured with the wrong helper-address pointing to an incorrect or non-existent server. The giaddr might be incorrect if the relay agent is configured with a different IP than the one expected by the server. Some older DHCP servers ignore the giaddr and try to match the source IP of the packet, which can lead to wrong address assignment. If the DHCP server is on a network that uses private addressing and the relay is behind a NAT, the relay might not be able to reach the server. Another issue is that the relay agent might be overwhelmed if there are too many clients sending broadcasts, especially in a large broadcast domain. In such cases, you might need to implement DHCP relay with multiple servers and load balancing.
Professionals should also know about DHCP Relay Agent Information Option (Option 82). This is used to add additional identifiers like circuit ID (typically the switch port) and remote ID (the switch MAC). This allows the server to assign IP addresses based on physical location, which is useful for security policies or for integrating with subscriber management systems in ISP networks. However, Option 82 must be supported by both the relay and the server. If the server does not support it, it may drop the packets. Some networks use 'trusted' and 'untrusted' ports for DHCP relay in combination with DHCP snooping to prevent rogue relays. Understanding these subtleties is what separates a novice from an experienced network engineer.
Memory Tip
DHCP relay: Router as a relay, 'ip helper-address' helps clients on other lanes. The giaddr is your location ID.
Learn This Topic Fully
This glossary page explains what DHCP relay means. For a complete lesson with labs and practice, see the topic guide.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
SY0-701CompTIA Security+ →AZ-104AZ-104 →SAA-C03SAA-C03 →200-301Cisco CCNA →N10-009CompTIA Network+ →ACEGoogle ACE →220-1101CompTIA A+ Core 1 →Legacy Exam Context
Older materials may mention these exam versions, but learners should use the current objectives for their target exam.
N10-008N10-009(current version)SY0-601SY0-701(current version)Related Glossary Terms
802.1Q is the networking standard that allows multiple virtual LANs (VLANs) to share a single physical network link by tagging Ethernet frames with VLAN identification information.
AAA (Authentication, Authorization, and Accounting) is a security framework that controls who can access a network, what they are allowed to do, and tracks what they did.
An A record is a type of DNS resource record that maps a domain name to an IPv4 address.
Frequently Asked Questions
Do I need a DHCP relay if my DHCP server is on the same subnet as the clients?
No, you do not need a relay if the server is on the same subnet. The client's broadcast will reach the server directly without any forwarding.
Can I use multiple DHCP servers with a single DHCP relay agent?
Yes, you can configure multiple helper addresses on the relay. The relay will forward the client's request to each server in order until one responds, providing redundancy.
What happens if the DHCP relay agent cannot reach the DHCP server?
The client will not receive an IP address and will eventually assign itself a link-local address, such as 169.254.x.x (APIPA). The relay agent will not send an error message to the client.
Is DHCP relay the same as DHCP forwarding?
Yes, the terms are often used interchangeably. Both refer to the process of forwarding DHCP broadcast messages across subnets as unicast traffic.
What port does DHCP relay use on the router?
The relay agent listens on UDP port 67 for client broadcasts and forwards them to the server on UDP port 67. The server replies on UDP port 68 to the relay.
What is the difference between a DHCP relay and a DHCP proxy?
A relay forwards messages without changing the content substantially (aside from adding giaddr). A proxy typically acts as an intermediary that can modify the message, such as by inserting option 82 or even handling DHCP on behalf of the server in certain cases.
Can a DHCP relay work with IPv6?
Yes, there is a DHCPv6 relay feature, which works similarly but uses multicast addresses (FF02::1:2) instead of broadcast. It is defined in RFC 3315.