The switch becomes an active DHCP referee: untrusted ports (all by default) may send Discover/Request; Offers and ACKs only come from trusted ports. Rogue DHCP server on a desk switch simply gets its replies dropped.

ip dhcp snooping
ip dhcp snooping vlan 10,20
interface Gi1/0/24
 ip dhcp snooping trust
! optional armour:
ip dhcp snooping limit rate 100

The by-product is the gold: the bonding table — IP ↔ MAC ↔ VLAN ↔ port, every legitimate lease. DAI and IP Source Guard both consume it. Also the fix for DHCP starvation attacks when combined with rate-limiting untrusted ports.

Verify: show ip dhcp snooping binding.