<div dir="ltr">Thanks for the clarification. Regards </div><div class="gmail_extra"> <div class="gmail_quote">2016-10-20 14:23 GMT-04:00 Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On to, 20 loka 2016, Carlos Raúl Laguna wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi Alexander, I do belive is a DNS problem, the command failing are host -t srv _ldap._tcp.ad_domain or dig SRV _ldap._tcp.ad_domain after checkig the logs a see this error "no valid DS resolving '_ldap._tcp.ad_domain /SRV/IN': 10.20.4.22#53" so i disable the dnssec validation on IPA and it work as expected, i will setup dnssec on the windows side and enable dns validation once more on IPA to see if can get the same outcome. </blockquote> When you use DNSSEC validation, your DNS infrastructure should all be using DNSSEC. This does not depend on whether you are deploying trust to AD or not. In fact, when installing FreeIPA server, you have option to disable DNSSEC validation (ipa-server-install --no-dnssec-validation). The same option exists in ipa-dns-install. -- / Alexander Bokovoy </blockquote></div> </div>