Thanks much. dnssec-validation was set to yes on the replica. No idea how that happened.
Works now.
Something else and not related I wondered about, is why some clients point to a certain
server (in my case the failing server).
This is seen with `sssctl domain-status <ipa domain>` under "Active
servers". Is the weight added to the SRV records only when server/dns service is down
and not when misconfigured/malfunctioning?