DHCP and DNS
How a device gets an address, why that stops working the moment you add a VLAN, and what a helper address does about it. Then the other half: what DNS is actually being asked, why resolution failures look like everything else, and the specific misconfigurations that produce a network which pings by address and fails by name.
Doing it
Why a request never arrives, and what to configure so it does — then the resolution half, which fails in a way that looks like everything else.
- 01
Understand why DHCP stops at the VLAN boundary
A client with no address broadcasts to find a server. Broadcasts do not cross a router, and a VLAN boundary is a router. So a scope that works perfectly on the VLAN the server sits in does nothing at all for the VLAN you just created — not because the scope is wrong, but because the request never arrives.
- 02
Put the helper on the client's gateway, not the server's
A helper address — `ip helper-address` on Cisco, DHCP relay elsewhere — tells the router to take that broadcast, turn it into a unicast, and forward it to the server. It goes on the interface serving the clients that need addresses. Configuring it on the wrong side is the most common reason a correct-looking helper does nothing.
CautionThe helper also forwards several other broadcast services by default. On a segment you do not fully trust, restrict which ones rather than relaying everything.
- 03
Make the scope match the subnet the request came from
The relay stamps the request with the interface address it arrived on, and the server picks the scope matching that subnet. If no scope matches, the server declines silently — there is no error at the client beyond a self-assigned address. Check the scope's subnet against the router interface, not against what you meant to build.
- 04
Reserve rather than statically assign
A reservation keeps the address in the server's view of the world, so the next person can see it, and it still hands out the current gateway and DNS. A static address on the device itself is invisible to everything and silently wrong the day the gateway changes. Reserve printers, access points and cameras; statically address the infrastructure that has to come up before DHCP does.
- 05
Hand out DNS servers that can answer for the domain
On a network with an internal domain, clients must use the internal resolvers — pointing them at a public resolver is the fastest way to break name resolution for everything internal while leaving the internet working. That asymmetry is exactly why it gets misdiagnosed as a general network problem.
CautionMixing an internal and a public resolver in the same client list is worse than either alone. Whichever answers first wins, so the failure becomes intermittent.
- 06
Test resolution separately from connectivity
Ping an address, then ping a name. Working by address and failing by name is a resolution problem and nothing else. Query a specific server directly rather than relying on the client's own order, so you find out which resolver is answering rather than that something is.
- What does ip helper-address actually do?
- It turns a client's DHCP broadcast into a unicast aimed at your DHCP server, so a request can cross a router that would otherwise drop it. It goes on the router interface facing the clients, not the one facing the server. It also relays several other broadcast-based services by default, which is worth restricting on segments you do not fully trust.
- I added a VLAN and nothing gets an address. Why?
- Almost always the missing helper. The clients are broadcasting, the router is not forwarding those broadcasts, and the server never hears the request. The second most common cause is a helper that is configured but a scope that does not match the subnet the relay stamped on the request — the server then declines without telling the client why.
- Reservation or static IP?
- Reservation for almost everything — printers, access points, cameras, anything that needs a predictable address but is not infrastructure. The address stays visible in one place and the device keeps receiving current gateway and DNS settings. Statically address only what must come up before DHCP does: the DHCP server, core routing, and management interfaces.
- Why is it always DNS?
- Because DNS fails in a way that resembles everything else. A resolution failure produces a timeout, not an error saying resolution failed, so it looks like a down server, a firewall rule, or a broken route. The one-second test is pinging by address and then by name: if the first works and the second does not, stop looking at the network.
- Can I just use a public resolver everywhere?
- Only on a network with no internal domain. If there is an internal DNS zone, a public resolver cannot answer for it, so internal names break while the internet keeps working — which is exactly the pattern that gets misdiagnosed for hours. Hand out internal resolvers and let them forward outward.
The rest of the section
- 01RJ45 Wiring: T568A and T568BBoth colour codes, pin by pin, side by side.
- 02RJ11 Wiring and Phone PinoutsSix positions, three lines, two colour systems.
- 03Keystone Jack TerminationStrip, seat, punch, snap — without failing the certification.
- 0466 Block WiringFifty rows, four columns, and where the bridging clips go.
- 05110 Block WiringLay the pairs in, press the connecting block on.
- 06Cat5e vs Cat6 vs Cat6a vs Cat8Speed, distance, and power decide it — not the bigger number.
- 07Fibre Types, Connectors and PolishRead the jacket, read the connector, don't mate blue to green.
- 08Subnetting, ExplainedWhere the numbers come from, and the meaning behind them.
- 09PoE Standards and Why It Won't PowerThe switch reserves the class, not the draw.
- 10Camera Lens, Field of View and Pixel DensityCovering the room is not the same as identifying a face in it.
- 11Patch Panels and Labelling to TIA-606A label that survives is worth more than a tidy rack.
- 12Rack Planning: Units, Depth, Weight and HeatIt fits vertically. That was never the hard part.
- 13Writing a Switch ConfigurationFrom factory default to a switch you would hand over.
- 14Networking and Cabling GlossaryThe terms, and what they mean on a job.
- 15POTS to VoIP: What BreaksThe lines nobody remembers until they stop working.
- 16Testing an Analogue Phone LineTip, ring, and the four numbers that tell you whose fault it is.
- 17Toning and Tracing a CableFinding one pair in a bundle of two hundred.
- 18Reading a Cable Certifier ReportWhat PASS* actually means, and which number to look at first.
- 19Which Cable Tester Do You Need?Three tiers, and the one most people actually need.
- 20Running an Office Floor RestackEveryone sits down Monday and their machine works.
- 21Cable Management for Desks and RacksTidy is a by-product. Serviceable is the point.
- 22Asset Tagging and CMDB AuditsThe scan is easy. Scanning it into the right record is the job.
- 23Cabling an Office Fit-OutHow many drops, run where, and what it takes to add one later.
- 24Parcel Locker Site SurveysWhether the unit fits, powers, connects — and gets in the door.
- 25VLANs and TrunkingAccess, trunk, tagged, native — and which one is the security hole.
- 26Spanning Tree and Switching LoopsWhy one patch cord can take a whole floor down in seconds.
- 27Reading a TracerouteWhich loss is real, and whose network it is in.
- 28Wi-Fi Channel Planning and AP PlacementMore access points at lower power, not fewer at maximum.
- 29SMART Attributes That Predict FailureA drive can report PASSED while it is visibly dying.
- 30BitLocker: Keys, Recovery and EscrowThe key exists somewhere, or the data does not.
- 31Grounding and Bonding a Telecom RoomOne ground, one path, and no loops between rooms.
- 32UPS Sizing: VA, Watts and RuntimeThe number on the box is not the number you need.
- 33Mounting Displays on Any WallFind the structure. Everything else is a repair bill.
- 34Mounting IP CamerasHeight, angle, and the surfaces that ruin the picture at night.
We do this work
as well as document it
Anyone who has just created a VLAN and found nothing on it gets an address, or is staring at a machine that pings by IP and not by name.