[Guide] Dnsmasq vs Kea DHCP on OPNsense: which one should I use?

[(MARLOO)]

Dnsmasq and Kea are related but solve different problems.

Dnsmasq is an all-in-one service: DNS forwarding/caching, DHCPv4/DHCPv6 and Router Advertisements.

Kea is a dedicated DHCP server only.

They are not direct replacements for each other: Dnsmasq is ideal for a simple integrated setup, while Kea is useful when you need more advanced DHCP features.

Key differences
Both Dnsmasq and Kea can provide DHCPv4 and DHCPv6, but their additional features are quite different.

Dnsmasq provides:

DNS forwarding and caching

Router Advertisements for IPv6

Dynamic registration of DHCP client hostnames in its own DNS

The ability to configure Unbound to forward/look up specific local domains in Dnsmasq

A simple integrated DNS/DHCP/RA setup

Basic DHCPv6 and conditional DHCP options

A basic DHCP HA setup using split pools and DHCP reply delay, but without lease synchronization

Kea provides:

API-based DHCP management and automation

Lease management through the Control Agent

DHCP high availability with lease synchronization

More advanced DHCPv6 Prefix Delegation and conditional DHCP options

RFC 2136 DDNS updates to an authoritative DNS server, such as BIND or PowerDNS

--DNS-- is the main difference

Dnsmasq can resolve and cache DNS queries, provide Router Advertisements and dynamically register DHCP client hostnames in its own DNS.

Unbound can then be configured to forward the relevant local forward and reverse zones to Dnsmasq, making DHCP client hostnames resolvable through Unbound.

Kea can advertise DNS servers to clients through DHCP options, but it does not provide a DNS resolver/cache, Router Advertisements or dynamic hostname registration in Unbound.

Kea's DHCP-DDNS component sends RFC 2136 updates to an authoritative DNS server, such as BIND or PowerDNS. It cannot use Unbound or Dnsmasq as the DDNS target.

With Kea, you still need Unbound for DNS and radvd for Router Advertisements if you use IPv6.
------------------------------------------------------------------------------------------------------------------------------------
Use Dnsmasq when:

You have one OPNsense firewall.

You have a LAN and a few VLANs.

You want DNS, DHCP and Router Advertisements in one service.

You want DHCP client hostnames to be resolvable through Unbound.

You do not need DHCP HA with lease synchronization, API automation or advanced DHCPv6 features.

This is the usual choice for a home lab or small network.
-----------------------------------------------------------------------------------------------------------------------------------------
Use Kea when:

You need API-driven DHCP automation.

You need lease management through the Control Agent.

You need DHCP high availability with lease synchronization.

You need advanced DHCPv6 Prefix Delegation or conditional DHCP options.

You prefer a clean, manually maintained DNS zone without dynamic client names.
-------------------------------------------------------------------------------------------------------------------------------------------
Bottom line

Both Dnsmasq and Kea can be valid choices for a home network.

Use Dnsmasq if you prefer an integrated DNS/DHCP/RA setup and want DHCP client hostnames to be automatically resolvable through Unbound.

Use Kea if you prefer a dedicated DHCP server, API-based management, DHCP HA with lease synchronization or a clean, manually maintained DNS zone without dynamic client names.

The best choice depends on your preferred DNS/DHCP workflow, not simply on whether the network is a home lab or a production environment.

See the original forum discussion here:
https://forum.opnsense.org/index.php?topic=53140.0

Note: This post is only intended to outline the main practical differences between Dnsmasq and Kea. It is not an official guide, a migration guide or a complete feature comparison.