diff --git a/service/cziti/dns.go b/service/cziti/dns.go
index 0f93d780..b3f7c5ef 100644
--- a/service/cziti/dns.go
+++ b/service/cziti/dns.go
@@ -33,7 +33,7 @@ type DnsManager interface {
 
 	RegisterService(svcId string, dnsNameToReg string, port uint16, ctx *ZIdentity, svcName string) (net.IP, error)
 	UnregisterService(host string, port uint16)
-	ReturnToDns(hostname string)
+	ReturnToDns(hostname string) net.IP
 }
 
 var initOnce = sync.Once{}
@@ -166,12 +166,12 @@ func (dns *dnsImpl) RegisterService(svcId string, dnsNameToReg string, port uint
 	return ip, nil
 }
 
-func (dns *dnsImpl) Resolve(toResolve string) net.IP {
+func (dns *dnsImpl) Resolve(toResolve string) *net.IP {
 	dnsName := normalizeDnsName(toResolve)
 	found := dns.hostnameMap[dnsName]
 	if found != nil {
 		if found.dnsEnabled {
-			return found.ip
+			return &found.ip
 		}
 	}
 	return nil
@@ -193,7 +193,10 @@ func (dns *dnsImpl) UnregisterService(host string, port uint16) {
 					log.Warnf("Unexpected error removing route for %s", icept.host)
 				}
 			} else {
-				dns.hostnameMap[icept.host].dnsEnabled = false
+				found := dns.hostnameMap[normalizeDnsName(icept.host)]
+				if found != nil {
+					found.dnsEnabled = false
+				}
 			}
 			delete(dns.serviceMap, key)
 		} else {
@@ -222,11 +225,12 @@ func (dns *dnsImpl) GetService(ip net.IP, port uint16) (*ZIdentity, string, erro
 	*/
 }
 
-func (dns *dnsImpl) ReturnToDns(hostname string) {
+func (dns *dnsImpl) ReturnToDns(hostname string) *net.IP {
 	dnsEntry := dns.hostnameMap[normalizeDnsName(hostname)]
 	if dnsEntry != nil {
 		dnsEntry.dnsEnabled = true
 	}
+	return &dnsEntry.ip
 }
 
 func DnsInit(tun api.DesktopEdgeIface, ip string, maskBits int) {
diff --git a/service/ziti-tunnel/service/ipc.go b/service/ziti-tunnel/service/ipc.go
index 588c25fd..9dca25eb 100644
--- a/service/ziti-tunnel/service/ipc.go
+++ b/service/ziti-tunnel/service/ipc.go
@@ -780,8 +780,8 @@ func connectIdentity(id *Id) {
 				//string, ZService
 				log.Warnf("ranging over services. key: %s", key)
 				val := value.(cziti.ZService)
-				cziti.DNSMgr.ReturnToDns(val.InterceptHost)
-				cziti.AddIntercept(val.Id, val.Name, val.InterceptHost, int(val.InterceptPort), id.CId.UnsafePointer())
+				ip := cziti.DNSMgr.ReturnToDns(val.InterceptHost)
+				cziti.AddIntercept(val.Id, val.Name, ip.String(), int(val.InterceptPort), id.CId.UnsafePointer())
 				id.Services = append(id.Services, nil)
 				return true
 			})
diff --git a/service/ziti-tunnel/service/state.go b/service/ziti-tunnel/service/state.go
index c39bd74f..1959d8b8 100644
--- a/service/ziti-tunnel/service/state.go
+++ b/service/ziti-tunnel/service/state.go
@@ -204,6 +204,7 @@ func (t *RuntimeState) LoadIdentity(id *Id) {
 
 	id.ControllerVersion = id.CId.Version
 	id.CId.Fingerprint = id.FingerPrint
+	id.CId.Loaded = true
 
 	// hack for now - if the identity name is '<unknown>' don't set it... :(
 	if id.CId.Name == "<unknown>" {