I've been studying the docs, and googling the Internet pipes, but it seems our environment is particular twisted.

We have hundreds of UNIX/Linux servers residing in the "x.org" DNS domain that have been using Sun LDAP servers for naming services and authentication.  DNS for the servers in this "x.org" domain is managed by Infoblox appliances.  However, now these Sun LDAP servers are being decommissioned.  Everything is being migrated to use AD instead.  The snag: the AD realm/DNS is CAMPUS.AD.X.ORG.  DNS for campus.ad.x.org is delegated to the AD DNS servers.

To further complicate things, probably because all email addresses are of the form "UUUU@x.org", the following SRV records are defined:

# host -t srv _kerberos._udp.x.org
_kerberos._udp.x.org has SRV record 0 100 88 rootdc11.x.org.
_kerberos._udp.x.org has SRV record 0 100 88 rootdc8.x.org.
_kerberos._udp.x.org has SRV record 0 100 88 rootdc12.x.org.
_kerberos._udp.x.org has SRV record 0 100 88 rootdc10.x.org.
# host -t srv _kpasswd._udp.x.org
_kpasswd._udp.x.org has SRV record 0 100 464 rootdc12.x.org.
_kpasswd._udp.x.org has SRV record 0 100 464 rootdc10.x.org.
_kpasswd._udp.x.org has SRV record 0 100 464 rootdc8.x.org.
_kpasswd._udp.x.org has SRV record 0 100 464 rootdc11.x.org.
# host -t srv _ldap._tcp.x.org
_ldap._tcp.x.org has SRV record 0 100 389 rootdc11.x.org.
_ldap._tcp.x.org has SRV record 0 100 389 rootdc10.x.org.
_ldap._tcp.x.org has SRV record 0 100 389 rootdc12.x.org.
_ldap._tcp.x.org has SRV record 0 100 389 rootdc8.x.org.

Do I simply set up the FreeIPA master as master.ipa.x.org, and set the realm name to be IPA.X.ORG?  Would all FreeIPA clients then be in the IPA.X.ORG realm?  Could they still remain in the x.org DNS domain?  Based on what I'm reading, I'm thinking maybe so, but I don't know if those SRV records above will break that.

Thanks in advance for any pointers!

Amos