While DHCP Request messages are allways sent via broadcast during DHCP Client initialization phase, DHCP Replies can be sent as both broadcast and unicast. Which method of sending will be used depends on the DHCP Server or DHCP Relay Agent and requirement of a DHCP Client.
DHCP Client can request that DHCP Replies are broadcasted in case that it's own IP protocol implementation software can not receive unicast IP packets untill it has valid IP address configured and that is the case in the initialization phase. In this case it will specifically request from DHCP Server or Relay Agent to sent DHCP Replies via broadcast by setiing the Broadcast bit of Flags fleld in DHCP Request messages to 1. In a case when DHCP client can receive unicast IP packets even though it does not have configured IP address, Broadcast bit is unset (0) and it is up to DHCP Server or Relay Agent to decide wheather it will send DHCP Replies via unicast or broadcast. Unicast is offcourse preffered method as it reduces network traffic and proccessing power of the clients.
In order to send packet/frame both IP address and MAC address need to be known to the sender. DHCP Server or Relay Agent knows both IP and MAC address, IP address as it is offering one and MAC address as it is contained in DHCP Request messages. However, standard sending packet procedure require that MAC address is obtained with ARP protocol and this can not work obviously as DHCP Client can not respond to ARP packets as it does not yet have an IP Address configured. Question is then, how can a DHCP Server or a Relay Agent send DHCP Replies via unicast? Is there a mechanism for accessing an ARP table and adding ARP entries directly?
The DHCP server can generate a raw packet and put the MAC and IP addresses into that. When sending raw packets, the OS doesn't do any checks for ARP entries or anything. So the packet will be a valid unicast UDP packet even though the client can't answer to ARP yet and the server doesn't have anything in the ARP tables.