Hi John, 

Thanks for the reply. Here's why I was thinking I could move to flat files:

I've noted that when creating ipa-replia servers, I have needed to specify '--setup-dns' along with a forwarding option if I wanted the server to configure named-pkcs11 to use the bind backend. Otherwise, named is not set-up and the ipa-replica server handles all other functions (authentication, mainly) just fine.

My thinking is that I would have 2 IPA servers that would still use named pointed at bind as they were set up, but my other ipa servers I would reconfigure named to use flat files, with the 'master' pointed at the 2 IPA servers I had left alone. 



On Thu, Sep 27, 2018 at 11:40 AM John Petrini <jpetrini@coredial.com> wrote:
I don't think it's possible for FreeIPA to operate on bind flat files
but I'll leave that to others who know better to answer.

I know you said you'd rather not spin up additional DNS servers but I
really think that's your best option. Build additional bind servers
that are slaves of FreeIPA and have FreeIPA act a a hidden DNS master.
If there's a problem with the DNS service on FreeIPA your slaves will
continue to handle all requests. Just my two cents, attempting to
change the way FreeIPA functions in order to improve availability may
have the opposite result.