diff --git a/roles/kerberos/kdc/templates/kdc.conf.j2 b/roles/kerberos/kdc/templates/kdc.conf.j2
index c2d0096..9f3259b 100644
--- a/roles/kerberos/kdc/templates/kdc.conf.j2
+++ b/roles/kerberos/kdc/templates/kdc.conf.j2
@@ -6,8 +6,9 @@
   admin_server = SYSLOG
 
 [kdcdefaults]
-  # listen udp port on localhost only
+  # listen on localhost only
   kdc_listen = 127.0.0.1:88
+  kdc_tcp_listen = 127.0.0.1:88
 
 [realms]
   {{ kerberos_realm }} = {