Usually, yes. Under Microsoft’s Windows Server licensing guidance, each user or device that accesses a licensed Windows Server requires a Windows Server base CAL. Because DNS and DHCP are Windows Server services, a client’s DNS queries or DHCP lease requests should generally be treated as access requiring coverage, even when the client is a workgroup computer, Linux system, guest device or makes an unauthenticated request.
This is a licensing interpretation, not a DNS/DHCP-specific exemption rule. Check the Product Terms, licensing program, server version and any contract-specific exception before finalizing your deployment.
As an Amazon Associate I earn from qualifying purchases.
What the CAL requirement covers
Microsoft states: “Each user or device that accesses licensed servers requires a Windows Server CAL (Base CAL).” Windows Server Standard and Datacenter therefore continue to require CALs for every user or device accessing a server.
A CAL is an access right; it is separate from the Windows Server license assigned to the physical or virtual server. Buying a server license does not by itself provide the required client access rights, and a CAL does not install or activate DNS or DHCP.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Why DNS queries and DHCP leases count as access
Microsoft identifies DNS and DHCP as Windows Server services. A DNS lookup sent to Windows DNS or a DHCP request handled by Windows DHCP is therefore access to a service running on the licensed server. The technical fact that the protocol can operate without an Active Directory logon does not create a licensing exemption.
- A workgroup client is not automatically exempt.
- A Linux or macOS client is not automatically exempt.
- A guest or unauthenticated DNS query is not automatically exempt.
- A DHCP lease request is still access to the Windows DHCP service.
The relevant question is who or what accesses the Windows Server, not whether the client authenticates to Active Directory.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Choose the right base CAL model
| Option | What is licensed | Usually fits |
|---|---|---|
| User CAL | One named user may access the licensed Windows Server from any device. | Employees who roam among laptops, desktops, phones or other devices. |
| Device CAL | One licensed device may be used by any number of users. | Shared workstations, shift-based terminals, classrooms or other environments with many users and a smaller device pool. |
| External Connector | External access to a particular physical server is covered instead of licensing each external user or device individually. | Qualifying populations outside the organization when per-user or per-device counting is impractical. |
Do not combine User and Device CALs casually as a substitute for counting. Select the model that matches your actual users, devices and access pattern. External Connector licensing applies per physical server accessed and must be evaluated under the applicable Microsoft terms.
Do guests, internet clients or unauthenticated requests change the answer?
Not automatically. Microsoft’s reviewed guidance does not list ordinary DNS resolution or DHCP leasing as a DNS/DHCP-specific exemption. A guest network using Windows DNS or DHCP should therefore be treated as requiring coverage unless a documented exception, External Connector, service-provider arrangement or equivalent license applies.
Rank #3
- Multi-WAN Business Continuity: Connect up to 5 ISPs with automatic failover and load balancing — if one connection drops, traffic instantly reroutes to keep your business, remote office, or home lab online
- OpenWRT-Ready Enterprise Control: Full OpenWRT support unlocks VLAN segmentation, advanced firewall rules, custom QoS policies, and community-developed packages for professional-grade network management
- Complete VPN Gateway Suite: WireGuard, OpenVPN, IPsec, PPTP, and L2TP server and client built in; create site-to-site tunnels, host remote access, or route specific VLANs through encrypted VPN connections
- Professional Security Stack: SPI firewall, DoS attack prevention, IP/MAC binding, domain filtering, and DMZ hosting protect your network perimeter while keeping critical services accessible
- Flexible Deployment & Monitoring: Web GUI or Cudy App cloud management with TR-069 support; built-in diagnostic tools (Ping, Traceroute, NSLookup, system logs) for rapid troubleshooting anytime
Technical isolation can still be valuable for security and operations, but a separate VLAN, captive portal, lack of domain membership or lack of credentials does not by itself settle the licensing question.
Exceptions that require a closer license review
Microsoft’s general guidance describes exceptions and special scenarios rather than a blanket DNS or DHCP waiver. The reviewed materials refer to circumstances such as access by another licensed server, qualifying web workloads, qualifying high-performance-computing workloads and certain Product Terms scenarios. Product Terms also identify targeted cases, including access solely to synchronize an Active Directory infrastructure with Microsoft Entra ID and certain CSP-hosting arrangements.
Rank #4
- WiFi 6 Mesh Wi-Fi - Next-gen Wi-Fi 6 AX3000 whole home mesh system to eliminate weak Wi-Fi for good(2×2/HE160 2402 Mbps plus 2×2 574 Mbps)¹²
- More than a WiFi Router - Deco X55 can work as a standalone Wi-Fi Router. All the TP-Link Deco Mesh can work together. Better than traditional WiFi Router and Range Extender
- Whole Home WiFi Coverage - Covers up to 2500 square feet with 1 Deco X55. Simply add more Deco if you need more coverage. Enjoy seamless high-performance Wi-Fi 6 and eliminate dead zones and buffering¹
- Our Cybersecurity Commitment - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement
- More Gigabit Ports - Each Deco X55 has 3 Gigabit Ethernet ports(6 in total for a 2-pack) and supports Wired Ethernet Backhaul for better speeds. Any of them can work as a Wi-Fi Router
These exceptions are fact-specific. Do not extend one to ordinary client DNS or DHCP traffic without confirming that the exact users, devices, servers and access purpose meet the governing terms.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do DNS or DHCP require additive CALs?
Ordinary use of Windows DNS and DHCP is not identified as requiring an additive CAL. Additive licensing applies to named advanced functionality, such as Remote Desktop Services, Active Directory Rights Management Services and Microsoft Identity Manager. If the same users or devices also use one of those functions, evaluate its additional CAL requirement separately from the base CAL covering Windows Server access.
Best Value
- Rapid Network Testing: One-button, 10-second pass/fail test verifies PoE, Link, DHCP, Gateway, and Internet connectivity
- Network Discovery: Shows nearest switch name/port and VLAN via CDP/LLDP/EDP protocols for comprehensive network mapping
- Wireless Connectivity and Cloud Integration: Built-in Wi-Fi hotspot for mobile UI; automatically uploads results to Link-Live cloud portal
- Portable Design: Pocket-sized, PoE or AA battery powered, designed for frontline and helpdesk teams as a pre-check tool before escalating to advanced testers
- Visual Feedback System: Lighted Indicator Icons provide instant status updates (Does not have a display or touch screen)
Version and edition checks
For Windows Server Standard or Datacenter, plan on base CAL coverage unless an applicable exception says otherwise. Microsoft’s current guidance says Windows Server 2025 CALs permit access to Windows Server 2025 and prior versions. Older CAL versions do not automatically grant rights to newer server versions.
Confirm the server version, edition, licensing program and any subscription or agreement terms. Microsoft recommends handling pricing and purchasing through a Microsoft representative or reseller; the commercial price is not the same thing as the legal scope of the access right.
Quick Recap
A practical counting procedure
- Inventory the Windows servers. Identify every physical or virtual Windows Server instance providing DNS, DHCP or other services.
- List actual accessors. Count the users or devices whose traffic reaches those services, including workgroup, Linux, guest and unauthenticated clients.
- Pick a counting basis. Use User CALs when people roam; use Device CALs when many people share a defined device pool.
- Assess external populations. For customers, partners, visitors or other external users, compare individual CALs with an External Connector for each accessed physical server.
- Check additional workloads. Review whether Remote Desktop Services, AD RMS, Microsoft Identity Manager or another separately licensed feature is also being used.
- Validate the agreement. Check the current Product Terms and licensing program, especially for hosting, outsourcing, synchronization-only access or mixed server versions.
Common mistakes
- “It is only DNS, so no CAL is needed.” DNS is still a Windows Server service.
- “DHCP is unauthenticated, so leases do not count.” Authentication and licensing are separate issues.
- “A server license includes unlimited clients.” Standard and Datacenter deployments generally require base CALs for accessing users or devices.
- “One CAL covers everyone.” A User CAL follows one named user; a Device CAL follows one device.
- “A base CAL covers every Microsoft server feature.” Additive CALs can apply to advanced functionality.
- “An old CAL is valid for any newer server.” Version rights are directional; verify them before upgrading.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
