I have been reading the technical documentation, but still cant figure out how a split brain scenario is avoided.
Lets say we have six sites, each site has its own DHCP scope and two others. Site A has a DHCP node which is responsible for its own DHCP scopes (A/B/C). and site B has a second node which is responsible for scope D/E/F. Each node is also configured as the stand-by partner for the scopes in the other site. So if the DHCP server dies in one site, the DHCP server in the other site becomes responsible for the scopes of the failed server, and so ensuring HA for DHCP.
Node A sitting in site A, responsible for scope A, B, and C. Has scope D, E and F as failover (Failover relationship 95/5).
Node B sitting in site B, responsible for scope D, E, and F. Has scope A, B and C as failover (Failover relationship 95/5).
Now, lets assume that both nodes are still available and only the communication between the failover nodes has failed. Server A will still be responsible for Scope A, B and C, and is able to lease addresses in Scope A, B and C. Clients in site A will still obtain a new lease from Server A, while clients in site B and site C will not be able to obtain a lease from server A. The clients of site B and C will obtain a lease from server B from the 5% with a lease duration of the MCLT (1 hour). When the MCLT expires, Server B will assume it is now responsible for the complete scopes as server A is still offline according to server B.
As Server A still get request for Zone A it will still be leasing addresses for that scope, after the expiry of the MCLT server B will assume it will also be responsible for scope A although it does not get any lease requests. What happens when the connection between the two servers is reestablished, and what if server B did lease addresses for Scope A?
Answers provided are coming from personal experience, and come with no warranty of success. I as everybody else do make mistakes.