Server 2012 R2 - The system failed to register host (A or AAAA) resource records (RRs) for network adapter

Question

We seem to be having an issue recently after introducing new Windows Server 2012 R2 servers where they fail to register DNS correctly. The Windows Firewall is off and the servers are on the same VLAN with no firewalls between them.
When I do an ipconfig /registerdns or wait 24 hours for the system to try we get the following error:
The system failed to register host (A or AAAA) resource records (RRs) for network adapter
with settings:
           Adapter Name : {4A0ECF05-193F-4BEA-AA46-BEC593BA752B}
           Host Name : SRV-DATA
           Primary Domain Suffix : internal.local
           DNS server list :
192.168.0.50, 192.168.0.42
           Sent update to server : <?>
           IP Address(es) :
             192.168.0.99
The reason the system could not register these RRs was because the DNS server contacted refused the update request. The reasons for this might be (a) you are not allowed to update the specified DNS domain name, or (b) because the DNS server authoritative
for this name does not support the DNS dynamic update protocol.
To register the DNS host (A or AAAA) resource records using the specific DNS domain name and IP addresses for this adapter, contact your DNS server or network systems administrator.
On our DNS server we have set for the internal.local zone Secure Updates only so that looks good because it is Active Directory that should be handling this authentication to update the record I assume. Just to mention that when also doing an ipconfig /regsiterdns
the update fails within a few seconds. 
Source: DNS Clients Events
Event ID: 8018
User: NETWORK SERVICE
This issue is only affecting Windows Server 2012 R2 clients and testing with Windows Server 2008 R2 clients works no issues. So is this a mis-configuration or a bug with Windows 2012 R2? I have checked all DNS settings on client / server which all look good
to me so reaching out now to see if anyone has any ideas?
Environment:
- Windows Server 2012 R2 Domain Controllers (Forest/Domain Levels 2012 R2)
- Windows Server 2012 R2 Client machines (Physical and Virtual)
- Windows Server 2008 R2 Client machines (Physical and Virtual)

Answer 1

The zone is configured as "Secure Only"
The PDC is the SOA for the zone
I dont have a packet capture from the DC, only the client. 
The query you asked me to run is too long to paste in here, however this is the DNS zone it cannot update:
NotifyServers                     : 
SecondaryServers                  : {10.2.0.3, 10.2.0.5}
AllowedDcForNsRecordsAutoCreation : 
DistinguishedName                 : DC=internal.local,cn=MicrosoftDNS,DC=ForestDnsZones,DC=internal,DC=local
IsAutoCreated                     : False
IsDsIntegrated                    : True
IsPaused                          : False
IsReadOnly                        : False
IsReverseLookupZone               : False
IsShutdown                        : False
ZoneName                          : internal.local
ZoneType                          : Primary
DirectoryPartitionName            : ForestDnsZones.internal.local
DynamicUpdate                     : Secure
IsPluginEnabled                   : False
IsSigned                          : False
IsWinsEnabled                     : False
Notify                            : NoNotify
ReplicationScope                  : Forest
SecureSecondaries                 : TransferToSecureServers
ZoneFile                          : 
PSComputerName                    : 
CimClass                          : root/Microsoft/Windows/DNS:DnsServerPrimaryZone
CimInstanceProperties             : {DistinguishedName, IsAutoCreated, IsDsIntegrated, IsPaused...}
CimSystemProperties               : Microsoft.Management.Infrastructure.CimSystemProperties