Where a DHCP server listens for devices joining a network and hands them an IP address, a default gateway, DNS servers and a lease time. It is why a laptop can join a Wi-Fi network without anyone configuring anything, and it works over UDP because the client has no address yet to hold a connection with.
Local-network only by design. A rogue DHCP server on a LAN can point every device at an attacker-controlled gateway, which is why managed switches offer DHCP snooping.
Port 67 reachable from outside your network means a firewall rule is wrong. DHCP is local-only by design and should never cross the network edge.
The port scanner will tell you whether 67 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.