Dnsmasq and Kea are related but solve different problems.
--Dnsmasq-- is an all-in-one service: DNS forwarding/caching, DHCPv4/DHCPv6 and Router Advertisements.
--Kea-- is a dedicated DHCP server only.
They are not direct replacements for each other: Dnsmasq is ideal for a simple integrated setup, while Kea is useful when you need more advanced DHCP features.
*** Key differences ****
Both Dnsmasq and Kea can provide DHCPv4 and DHCPv6, but their additional features are quite different.
---Dnsmasq provides:--
- DNS forwarding and caching
- Router Advertisements for IPv6
- Dynamic registration of DHCP client hostnames in Unbound
- A simple integrated DNS/DHCP/RA setup
- Basic DHCPv6 and conditional DHCP options
--Kea provides:--
- API-based DHCP management and automation
- Lease management through the Control Agent
- DHCP high availability with lease synchronization
- More advanced DHCPv6 Prefix Delegation and conditional DHCP options
- RFC 2136 DDNS updates to an authoritative DNS server, such as BIND or PowerDNS
## DNS is the main difference ##
Dnsmasq can resolve and cache DNS queries, provide Router Advertisements and dynamically register DHCP client hostnames in Unbound.
Kea can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements or dynamic hostname registration in Unbound.
Kea's DHCP-DDNS component sends RFC 2136 updates to an authoritative DNS server, such as BIND or PowerDNS. It cannot use Unbound or Dnsmasq as the DDNS target.
With Kea, you still need Unbound for DNS and `radvd` for Router Advertisements if you use IPv6.
------ Use Dnsmasq when
- You have one OPNsense firewall.
- You have a LAN and a few VLANs.
- You want DNS, DHCP and Router Advertisements in one service.
- You want DHCP client hostnames to be resolvable in Unbound.
- You do not need DHCP HA, API automation or advanced DHCPv6 features.
This is the usual choice for a home lab or small network.
--------Use Kea when
- You need API-driven DHCP automation.
- You need lease management through the Control Agent.
- You need DHCP high availability with lease synchronization.
- You need advanced DHCPv6 Prefix Delegation or conditional DHCP options.
- You prefer a clean, manually maintained DNS zone without dynamic client names.
------Bottom line
Both Dnsmasq and Kea can be valid choices for a home network.
Use --Dnsmasq-- if you prefer an integrated DNS/DHCP/RA setup and want DHCP client hostnames to be automatically resolvable in Unbound.
Use --Kea-- if you prefer a dedicated DHCP server, API-based management, DHCP HA or a clean, manually maintained DNS zone without dynamic client names.
The best choice depends on your preferred DNS/DHCP workflow, not simply on whether the network is a home lab or a production environment.
See the original forum discussion here:
https://forum.opnsense.org/index.php?topic=53140.0
Note: This post is only intended to outline the main practical differences between Dnsmasq and Kea. It is not an official guide, a migration guide or a complete feature comparison.