I am remotely AE enrolling Zebra devices to an on-premise Deployment Server.   The on-premise DS network has a public IP address and firewall rules that will NAT ports 5494 and 443 to the DS.  This is restricted even further by only allowing this traffic from the remote public IP address that the device is being enrolled from.  The FQDN of the enrollment Rule and DMA are published in a private DNS zone local to the enrollment location.   
On Android 8, Zebra devices will properly resolve to the local DNS and enroll in the remote DS properly.   
The Zebra Android 10 devices will not resolve the local 

The DS and DMA FQDNs are published in a local DNS zone but not in a public DNS.  The GoogleMobiControl Agent on Zebra Android 8 devices will resolve to the local DNS and enroll properly.  The same agent on Zebra Android 10 will not resolve the local DNS and the agent will fail to connect to the DS without a public DNS entry.   
The agent enrollment error with an enrollment ID is “Fail to connect to Server”  Using the enrollment URL, the error is “Invalid URL”  
On the Zebra Android 10, the WiFi utilities will resolve the DNS FQDN as will Chrome resolve to the MS Web Console login (same FQDN).  
It seems that only the GoogleMobiControl Agent will not resolve a local DNS Zone on Android 10.

I tried this using the current agent:  GoogleMobiControl1513_1071.apk and an older agent: GoogleMobiControl1450_1011.apk with the same results.  I have not tested this with other mfg devices i.e. Samsung.

I have two scenarios where the on-prem DS/DMA FQDN is also a public domain  i.e. DSserver.mycompany.com where the host can be added to that public DNS zone.  

I have additional scenarios where the DS/DMA FQDN is internal i.e. DSserver.mycompany.local and cannot be published to public DNS.  I cannot enroll Android 10 devices to those DS servers remotely.  

Any thoughts?