[Freeipa-users] can clients or servers be pinned to named Active Directory servers to bypass DNS auto-discovery?

Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?

We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment

Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?

Thanks!

Chris