samba - Jan 2018 - AD - Some Mac clients fail to update with BIND9_DLZ

I have a mostly working AD setup running with Samba on Debian 9 with the
DNS backend BIND9_DLZ.

One problem I noticed, however, is that some Mac clients are unable to run
DDNS updates. There is one working and two failing in my test environment.
The one that works is running 10.8.5, with nsupdate -g succeeding. The ones
that fail are running 10.13.2, with nsupdate -g complaining it's not linked
to the needed GSSAPI libraries.

How can I get these machines to update their DNS successfully?