DHCP vs DNS — What Each One Does and Why You Need Both

DHCP and DNS are two completely different services that get confused because both are essential, both are usually running on the same router, and both cause “the internet is down” when they fail.

• DHCP gives your device an IP address so it can be on the network.
• DNS converts names like google.com into IP addresses so your device can find things on it.

A device with no DHCP has no address and cannot communicate at all. A device with no DNS has a working connection but cannot resolve any name, ping 8.8.8.8 succeeds while ping google.com fails. That difference is the fastest way to tell them apart when troubleshooting.

Side by Side

How DHCP Works, DORA

The exchange has four steps, remembered as DORA:

1. Discover, the client has no address, so it broadcasts to 255.255.255.255 asking if any DHCP server is out there.
2. Offer, a server responds with an available address and the accompanying configuration.
3. Request, the client broadcasts that it accepts that specific offer. It broadcasts rather than unicasts so that any other servers that made offers know to release theirs.
4. Acknowledge, the server confirms and records the lease.

The client receives more than just an address:

• IP address and subnet mask
• Default gateway
• DNS server addresses, this is where the two services connect
• Lease duration
• Optionally: NTP servers, domain name, TFTP server, PXE boot options

Lease renewal

At 50% of the lease time (T1) the client tries to renew directly with its server. At 87.5% (T2) it broadcasts to any server. If the lease expires entirely, the client must start over with Discover.

DHCP relay

DHCP Discover is a broadcast, and routers do not forward broadcasts. So a client in VLAN 20 cannot reach a DHCP server in VLAN 10 without help. A DHCP relay agent (Cisco’s ip helper-address) on the router’s VLAN interface converts the broadcast into a unicast to the server:

Router(config)# interface Vlan20
Router(config-if)# ip helper-address 10.10.10.5

Forgetting this on a new VLAN is one of the most common reasons a freshly configured VLAN “has no internet”.

How DNS Works

Resolving www.example.com walks down a hierarchy:

1. The client checks its own local cache and hosts file.
2. It asks its configured recursive resolver, usually the router, the ISP, or a public resolver like 1.1.1.1 or 8.8.8.8.
3. If the resolver has no cached answer, it asks a root server, which points it to the .com nameservers.
4. The TLD servers point it to the authoritative nameservers for example.com.
5. The authoritative server returns the actual record.
6. The resolver caches the answer for its TTL and returns it to the client.

Record types worth knowing

Where They Interact

They are separate protocols, but they meet in three places:

1. DHCP tells clients which DNS servers to use (option 6). Change that setting and every device on the network changes resolver on its next renewal.
2. DHCP can supply the search domain (option 15), so ping fileserver resolves as fileserver.company.local.
3. Dynamic DNS, in Active Directory environments, the DHCP server registers each client’s name in DNS as it hands out the lease, so hostnames resolve without manual records.

Diagnosing Which One Is Broken

Useful commands

# Windows
ipconfig /all                 # current address, gateway, DNS servers, lease times
ipconfig /release             # drop the lease
ipconfig /renew               # request a new one
ipconfig /flushdns            # clear the resolver cache
nslookup google.com
nslookup google.com 8.8.8.8   # bypass the configured resolver

# Linux / macOS
ip addr
dhclient -r && dhclient       # release and renew
dig google.com
dig @8.8.8.8 google.com
resolvectl status             # systemd resolver state

nslookup google.com 8.8.8.8 is the single most useful test: if that works but plain nslookup google.com does not, your configured resolver is the problem, not DNS as a whole.

Security Considerations

Both protocols were designed without authentication and both are attacked accordingly.

• Rogue DHCP servers hand out a malicious gateway and resolver, putting the attacker in the traffic path. DHCP snooping on the switch blocks DHCP replies from untrusted ports and is the standard defence, and it is also the prerequisite for Dynamic ARP Inspection.
• DNS spoofing and cache poisoning return forged answers to send users to attacker-controlled servers. DNSSEC signs responses cryptographically; DoH and DoT encrypt the query so it cannot be observed or altered in transit.
• DNS is also a common exfiltration channel, data encoded into subdomain queries leaves networks that block everything else. Monitoring DNS query volume and entropy catches it.

Frequently Asked Questions

Can DNS work without DHCP?

Yes. Configure the address and resolver statically and DNS works fine. DHCP is just the usual way those settings get delivered.

Can DHCP work without DNS?

Yes. Devices get addresses and can communicate by IP. They simply cannot resolve names, so browsing does not work.

Which one do I change to use Cloudflare or Google DNS?

DNS, but you set it in the DHCP server’s configuration (usually the router) so every client receives it, or per-device if you only want to change one machine.

Is my router the DHCP server or the DNS server?

Typically both. It runs a DHCP server for the LAN and a DNS forwarder that relays queries to your ISP’s resolvers or whichever ones you configure.

What happens when a DHCP lease expires?

The client attempts renewal at 50% and again at 87.5% of the lease. If both fail and the lease runs out, it releases the address and restarts the DORA process. If no server answers, it self-assigns a 169.254.x.x address.

Why do I have two DNS servers configured?

Redundancy. If the primary does not answer within the timeout, the client tries the secondary. A slow or unreachable primary makes everything feel sluggish even though it eventually works, which is why an unresponsive primary is worth fixing rather than tolerating.