DHCID record
Stores a DHCP client identifier in DNS so an automated update service can identify the client that owns a name.
Written and maintained by Ben Ennis
Last reviewed July 27, 2026 · How we verify this
Zone-file example
host.example.com. 3600 IN DHCID AAIBY2xpZW50LWlkZW50aWZpZXI=Typical uses
- Letting a DHCP server prove which client created a dynamically updated name
- Preventing one client from deleting or replacing another client's address record
- Keeping forward and reverse records safe when leases move between addresses
- Auditing dynamic DNS ownership alongside the lease database
When it breaks, check
- The DHCID value must be calculated from the same client identifier and FQDN as the updater
- A stale DHCID can block a legitimate replacement until the old lease owner is reconciled
- Do not treat the opaque value as a human-readable hostname or MAC address
- Dynamic update authorization and the DNS zone's transfer controls still protect the record
What the DHCID record does
DHCID is an ownership marker for DHCP-driven DNS updates. When a server creates an address record, it can create a DHCID record derived from the client identifier and the fully qualified domain name. On a later lease event, the server calculates the expected value again. A match supports replacement or deletion; a mismatch is a protection signal that should stop the update or send it through an explicit reconciliation policy.
The record is useful because an IP address can move between clients while the DNS name remains in a shared update zone. It does not replace TSIG, SIG(0), or the access policy that authorizes dynamic updates. For a live record check, use the DNS lookup tool; inspect SOA serials when checking propagation.
Zone-file and wire format
DHCID RDATA is encoded as a variable-length opaque octet string and is commonly shown as base64 in a zone file. The value is not meant to be edited by hand. The DHCP update implementation chooses the identifier source and calculation procedure, so copy-pasting a value between zones can create an ownership mismatch even when the text looks valid.
; illustrative opaque DHCID value
host.example.com. 3600 IN DHCID AAIBY2xpZW50LWlkZW50aWZpZXI=Common uses
DHCID fits centrally managed DHCP and dynamic DNS, especially when several clients can receive the same lease or when forward and reverse updates are coordinated. Keep the record in the same update transaction as the address record. It is not a substitute for DNSSEC or for an authenticated update channel, and it is not a general-purpose device inventory record.
Troubleshooting
When an update is rejected, compare the requesting client’s identifier, the exact FQDN, and the DHCID already stored at the authoritative server. Then check the DHCP lease database for a previous owner and inspect the dynamic-update log for the reason code. Do not delete the DHCID as a first fix: doing so can remove the ownership evidence that prevents an accidental takeover.
If a lease was intentionally rehomed, use the DHCP server’s supported conflict-resolution or cleanup procedure, update the address and DHCID atomically, and verify the SOA serial afterward. Query an authoritative server directly if a recursive resolver is still returning a cached record.
dig host.example.com DHCID +noall +answer
dig host.example.com A +noall +answer
# Compare the authoritative answer during an update incident.
dig @ns1.example.net host.example.com DHCID +norecurse +noall +answerThe defining RFC
DHCID is defined by RFC 4701, which specifies the DHCP Client Identifier option in DNS and the opaque RDATA format. RFC 4703 describes how DHCP servers use DHCID records when updating DNS. The IANA DNS Parameters registry records the assigned type.
Reference and tooling
Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.