Domain controller registers Enclave adapter IP in DNS¶

Installing Enclave directly on a Windows server that runs DNS services (most commonly an Active Directory domain controller) is not recommended. Use an Enclave Gateway adjacent to the server instead.

Symptoms¶

Domain-joined clients intermittently fail to reach the domain controller
LDAP, Kerberos, or Group Policy lookups resolve to a 100.64.x.x address that is not routable on the LAN
DNS queries for the server's hostname return both its LAN IP and an unexpected Enclave IP, with clients receiving either at random

Cause¶

When Enclave is installed on a system, it creates a virtual network adapter with an IP address in the 100.64.x.x range. On a standard workstation or application server this is harmless. However, Windows servers running DNS services automatically register all of their network adapter IP addresses in DNS. This is by design — Microsoft calls it DNS registration on a multihomed domain controller.

The result is that the server's hostname resolves to both its LAN IP address (e.g. 172.16.1.10) and its Enclave IP address (e.g. 100.64.0.50). Clients that are not part of the Enclave network will intermittently receive the Enclave IP and fail to connect.

The behaviour is not specific to Enclave; any software that creates an additional network adapter on a Windows DNS server can trigger it. This applies to any Windows server where the DNS Server role is installed, not only Active Directory domain controllers.

Resolution¶

Deploy an Enclave Gateway on a separate Linux system (a VM, container, or physical device) adjacent to the domain controller, on the same network. The gateway routes traffic from Enclave-enrolled devices to the domain controller's LAN IP without adding a network adapter to the domain controller itself.

See Accessing on-premise Active Directory servers for a step-by-step guide with a reference architecture, including high-availability gateway pairs and the required ports for Active Directory services.

Last updated July 22, 2026