Hi,
I am currently using Dnsmasq for DHCP and DNS on my OPNsense home lab, with a LAN and several VLANs. Everything is working fine.
I am evaluating whether Kea DHCP would give me any real advantage for my setup. I only want to understand the concrete benefits of Kea compared with Dnsmasq DHCPv4.
An important difference is DNS integration. Dnsmasq is a combined DNS, DHCP and Router Advertisement service: it can resolve and cache DNS queries, provide Router Advertisements, and dynamically register DHCP client hostnames in Unbound.
Kea is DHCP-only. It can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements, or dynamic hostname registration in Unbound. With Kea, Unbound and radvd are still required for a full DNS/DHCP/RA setup.
Kea does have a DDNS Agent, but it only sends RFC2136 updates to an authoritative DNS server such as BIND or PowerDNS. Recursive DNS servers such as Dnsmasq or Unbound cannot be used as the target for those updates.
For a home lab with a few VLANs, fewer than 1000 clients, no HA pair, no RFC2136 DDNS and no complex PXE/IPv6 requirements, I see no practical advantage in switching from Dnsmasq to Kea.
The only concrete advantages I can identify are:
1. Deleting individual leases from the GUI through the Control Agent.
2. API-based DHCP management/automation.
3. HA with lease synchronization, if I later deploy a second OPNsense firewall.
4. More advanced DHCPv6 Prefix Delegation and conditional DHCP options.
I also saw a recent thread where static Dnsmasq reservations did not seem to work for some devices, possibly because of DUID-based client identification or an old dynamic lease that was never released. However, that is not the main reason for my question.
So, my question is: does Kea offer any real advantage for a multi-VLAN home lab compared with Dnsmasq DHCPv4, especially considering that Kea does not provide DNS, Router Advertisements or dynamic hostname registration in Unbound?
Thanks.
No.
Quote from: (MARLOO) on October 12, 2026, 08:48:36 PMI am evaluating whether Kea DHCP would give me any real advantage for my setup.
I would say you have perfectly done your homework and there is not much/nothing to add to what you know so far :)
Thanks both for confirming.
That was exactly the conclusion I was leaning towards: for a single-firewall, multi-VLAN home lab without HA, RFC 2136 DDNS or advanced DHCPv6 requirements, Dnsmasq's integrated DNS/DHCP/RA behaviour is more practical than gaining Kea's API and HA features.
I'll stay with Dnsmasq and revisit Kea only if I later deploy a second OPNsense firewall or need API-driven DHCP automation.
I use Kea and Unbound because it's simpler. I don't want dynamic DHCP clients polluting my carefully maintained DNS zone. Why would I want "Paddys-Macbook-Pro" in my DNS? DNS entries are for servers that need to be reachable by clients, have certificates, etc.
My approach. Yours is different.
@Patrick M. Hausen
I understand your point: in a carefully maintained DNS zone, dynamic client names would be unwanted noise.
In my home lab, however, dynamic registration is a deliberate convenience. It lets me reach laptops, VMs, phones and IoT devices by name without maintaining a static DNS entry for every temporary client.
For servers, infrastructure and services that need stable names or certificates, I agree that explicit static DNS records are the right approach. So it is not really Dnsmasq versus Kea: it is whether you want automatic client-name registration or a clean, manually managed DNS zone.
I will stay with Dnsmasq, but use static records for the important services and infrastructure.
Both approaches are valid; yours is probably the better fit for a production-like DNS environment, while mine is the better fit for a frequently changing home lab.