You may notice in your server's DHCP or DNS logs that a computer with the Cisco Umbrella roaming client installed is performing two Dynamic DNS (DDNS) updates within a few seconds of each other.
Windows is designed to perform a Dynamic DNS update whenever a network's IP or DNS settings are modified.
The design of the Umbrella roaming client causes the IP of the local client to be modified. First, the Umbrella roaming client backs up the DHCP-delegated (or statically-set) DNS servers to a local .txt file. Then the Umbrella roaming client binds itself to 127.0.0.1, and changes the DNS settings. This takes place for each network that has connectivity.
When the Umbrella roaming client changes the DNS settings, Windows performs a subsequent DDNS reregistration shortly after the original DDNS query is made and before the Umbrella roaming client takes over.
What to do?
There is no action for you to take. This behavior is innocuous in nature, and this article is for informational purposes only. Currently, there are no plans to attempt to avoid the second DDNS call when the Umbrella roaming client changes the DNS settings as no side-effects of this behavior have been noted.
For more information on how DDNS works on Windows, please see the following Microsoft article: Understanding Dynamic Update.