A DHCP relay is a function, usually running on a router or Layer 3 switch, that receives broadcast DHCP messages from clients on a local subnet and forwards them as unicast to a DHCP server on a different subnet, then returns the server’s replies to the client. In address configuration, it is what allows one central DHCP server to hand out addresses to many VLANs and sites without placing a server on every network segment.
The relay is defined by the BOOTP relay agent rules in RFC 951 and RFC 1542, and the same role exists for IPv6 as the DHCPv6 relay agent. Vendors often call the feature an IP helper address or DHCP helper.
Why DHCP needs a relay
A client that has just connected has no IP address yet, so it sends its DHCPDISCOVER to the limited broadcast address 255.255.255.255 from source 0.0.0.0. Routers do not forward broadcasts, which means the request never leaves the client’s subnet. Without a relay, every VLAN would need its own DHCP server.
The relay solves this by acting as a proxy at the edge of each subnet. It listens on the client-facing interface for UDP port 67 traffic and passes it to one or more configured server addresses, turning a local broadcast problem into ordinary routed unicast traffic.
Centralizing DHCP through relays also has security and operational benefits. Address assignment logs sit in one place, reservations and options such as DNS servers or boot settings are maintained once, and rogue servers are easier to detect, because DHCP snooping on access switches can mark only the uplink toward the relay as trusted. The trade-off is a dependency on the routed path: if the link to the central server fails, new clients on remote subnets cannot obtain addresses until it returns.
How a DHCP relay forwards messages
The relay modifies each message so the server knows where it came from. The key field is giaddr, the gateway IP address: the relay writes the IP address of the interface that received the request. The server uses giaddr to select the correct address scope for that subnet, and it sends its reply back to that address.
| Step | Client to relay | Relay to server | Relay action |
|---|---|---|---|
| Discover | Broadcast | Unicast to server | Sets giaddr, increments hop count |
| Offer | Unicast or broadcast | Unicast to giaddr | Delivers offer on the client subnet |
| Request | Broadcast | Unicast to server | Keeps giaddr, may add option 82 |
| Acknowledge | Unicast or broadcast | Unicast to giaddr | Removes option 82, delivers ACK |
The relay also increments a hops field and drops messages that exceed a configured limit, which protects against forwarding loops. Lease renewals usually bypass the relay, because a client that already holds an address can unicast directly to the server.
Option 82 and relay information
Relays can insert the Relay Agent Information option, known as option 82, which identifies the physical source of a request. Its Circuit ID sub-option typically names the switch port or VLAN, and its Remote ID names the relay device. Servers can use these values to assign addresses per port, apply policies or log exactly where a device connected.
Option 82 is widely used by service providers and in campus networks with DHCP snooping. A common pitfall is a switch that inserts option 82 with an empty giaddr; some servers reject such packets, so administrators either configure the server to trust them or disable insertion on the access switch.
DHCP relay compared with related approaches
A relay is one of several ways to deliver addresses to multiple subnets. The table places it next to the alternatives that network designers usually consider.
| Approach | Where the server runs | Strength | Weakness |
|---|---|---|---|
| DHCP relay | Central server, relay per subnet | Single place to manage scopes | Depends on routing to the server |
| Local DHCP per subnet | On each router or VLAN | Works if the WAN is down | Scopes scattered across devices |
| Multi-homed server | One server with an interface in each VLAN | No relay configuration | Does not scale beyond a few VLANs |
| SLAAC (IPv6) | No server, router advertisements | Stateless and simple | Limited central control of addresses |
In IPv6, the DHCPv6 relay encapsulates the client message in a Relay-Forward message and sends it to the server or to the multicast group FF05::1:3. Information that IPv4 carries in giaddr travels in the link-address field, and options such as the Interface-ID play a role similar to option 82.
Configuring and troubleshooting a relay
Configuration is short: on each client-facing Layer 3 interface, specify one or more helper server addresses, and on the DHCP server define a scope for each subnet whose range matches the relay interface address. Pointing to two servers in different locations provides redundancy when the servers run in a failover pair.
| Symptom | Likely cause | Fix |
|---|---|---|
| Clients get APIPA addresses | Relay not configured on the VLAN interface | Add the helper address on that interface |
| Server logs requests but clients get nothing | No scope matching giaddr | Create the scope for that subnet |
| Replies never reach the relay | Firewall blocks UDP 67 or 68 | Permit DHCP between relay and server |
| Requests dropped at the switch | Option 82 with empty giaddr | Trust the option or disable insertion |
| Other broadcast services also forwarded | Helper forwards several UDP ports by default | Restrict forwarded protocols |
When diagnosing, capture on both sides of the relay: if discovers arrive on the client side but no unicast leaves toward the server, the relay configuration is at fault; if unicast leaves but no offer returns, the cause is routing, filtering or the server scope.
The idea in brief
A new device on a network has no address yet. It shouts a question: who can give me an address? That shout only reaches devices in the same room. If the address server sits in another room, it never hears it.
A DHCP relay is like a receptionist. It hears the shout, phones the address office and passes back the answer. One office can then serve the whole building. The receptionist also says which room the caller is in, so the address fits that room.
A practical scenario
A school network has 12 VLANs for staff, students, printers, cameras and guests, all routed by a core Layer 3 switch. Rather than running 12 DHCP services, the IT team operates two Windows DHCP servers in a failover pair in the server room and configures each VLAN interface on the core switch with both servers as helper addresses.
One morning, laptops in a newly added classroom VLAN receive 169.254 addresses. The server log shows the requests arriving with a giaddr of 10.20.40.1, but no scope exists for 10.20.40.0/24. The team creates the scope with the right gateway and DNS options, and every laptop obtains an address within a minute, without touching any other part of the network.