I am running into an issue with FreeIPA and DNS. Perhaps, you guys could point me to a better realm/domain solution.

- I run a private DNS zone on AWS, called "int.example.com" (with ptr and srv, etc)
- I have 3 master-master-master IPAs called ipa1, ipa2, and ip3 xxx.int.example.com
- Realm is EXAMPLE.COM
- Domain is example.com
- example.com records are hosted in a different service (i.e. hover or godaddy)

When I try to install a client I get:

Discovery was successful!
Client hostname: ipaclient.int.example.com
DNS Domain: example.com
IPA Server: ipa2.int.example.com
BaseDN: dc=example,dc=com
Enrolled in IPA realm EXAMPLE.COM
Created /etc/ipa/default.conf
Configured /etc/krb5.conf for IPA realm EXAMPLE.COM
trying https://ipa2.int.example.com/ipa/json
Traceback (most recent call last):
  File "/sbin/ipa-client-install", line 3128, in <module>
  File "/usr/lib/python2.7/site-packages/ipalib/rpc.py", line 931, in create_connection
    raise errors.KerberosError(message=unicode(krberr))
ipalib.errors.KerberosError: Major (851968): Unspecified GSS failure.  Minor code may provide more information, Minor (2529639066): Cannot find KDC for realm “EXAMPLE.COM"

Any idea how I can overcome this issue? 

I would like my LDAP basedn to be dc=example,dc=com. I don't want it to take the value of dc=int,dc=example,dc=com if I used private domain int.example.com instead of example.com

I was thinking of using a private zone just example.com instead of int.example.com but I will have issues since my TLD is on an external service (i.e. hover.com). In this case, I wouldn't be able to resolve test.example.com within the private zone since AWS Route53 wouldn't resolve outside the zone. I would need to install a DNS forwarder somewhere else and I don't want to manage it.

I can manually install the client and specify the domain and realm fine but I am unable to use DNS _srv_ for failover if ipa1 goes down, for example. Clients are unable to login with a similar KDC error. And even installing is causing issues as the output show "Cannot find KDC for realm..."

Any recommendation or help would be appreciated. I am not sure what is the best solution.