# Verify DHCP option 119 support on the client before changing pfSense search domains

> A configured search list is ineffective when the client does not request or use the option.

- Canonical URL: https://update.dsesecurity.com/updates/verify-dhcp-option-119-support-on-the-client-before-changing-pfsense-search-domains/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:22+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A configured search list is ineffective when the client does not request or use the option.

## Potentially affected

This concerns DHCP-delivered DNS search-domain lists.

## DSE recommendation

DSE recommends recording the client operating system and its supported configuration method before editing the firewall.

## Article

A configured search list is ineffective when the client does not request or use the option.

## Source facts

Netgate states that pfSense delivers DNS search domains through DHCP option 119 to clients requesting it. Client support is not universal, including older Windows DHCP clients described in the guide. For clients that cannot use the option, the source identifies Group Policy as an alternative configuration path rather than changing the DHCP server brand.

Source: [Netgate — Using DHCP Search Domains on Windows DHCP Clients](https://docs.netgate.com/pfsense/en/latest/services/dhcp/client-search-domain.html).

## Applicability

This concerns DHCP-delivered DNS search-domain lists.

## DSE recommendation

DSE recommends recording the client operating system and its supported configuration method before editing the firewall. Check whether local settings, domain policy, or endpoint management overrides the received list. Keep the intended suffix order documented because short-name lookups can resolve differently when that order changes. Prefer fully qualified names for critical service checks so a search-list fault is not confused with a missing authoritative record. Group the pilot by actual client capability and management method. Preserve the effective suffix list and the option request evidence together for each group. Where policy supplies the setting, name that owner explicitly so a DHCP change is not credited for a result produced elsewhere.

## Verification

On an approved representative client, inspect the DHCP request and effective DNS search list after renewal. Compare a fully qualified lookup with a short-name lookup. If option 119 is absent or ignored, use the supported client-management method and verify the resulting configuration without repeatedly changing unrelated DHCP settings.

## Official reference

[Netgate — Using DHCP Search Domains on Windows DHCP Clients](https://docs.netgate.com/pfsense/en/latest/services/dhcp/client-search-domain.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — Using DHCP Search Domains on Windows DHCP Clients
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/services/dhcp/client-search-domain.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify DHCP option 119 support on the client before changing pfSense search domains,” DSE Security, https://update.dsesecurity.com/updates/verify-dhcp-option-119-support-on-the-client-before-changing-pfsense-search-domains/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.