Address where the Kea DHCP-DDNS daemon listens for name-change requests from DHCPv4 and DHCPv6. Most packaged configurations bind this to 127.0.0.1 so only local Kea daemons can submit DNS update requests.
Use a non-local address only when D2 must accept requests from another trusted host and firewall rules protect the listener.