That's correct. Apparently it's on able to use the Kerberos credential to utilize that service associated with the server. Have you examined the key tab itself? Read it in and see what's inside of it. <div class="gmail_quote"><div dir="ltr">On Fri, Oct 7, 2016, 12:20 Fil Di Noto <<a href="mailto:fdinoto@gmail.com">fdinoto@gmail.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I'm trying to interpret these log messages. It seems like server ipa03 has no principal for the DNS service and is not able to replicate LDAP to the other 3 IPA servers. If that is correct: 1. Is "DNS" the service principal it should be using? 2. How do I correct this? (what concerns me is that ipa03 is the server I designated as the server where administrative changes are made in case manual replication is needed) Oct 7 18:38:47 <a href="http://ipa02.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa02.example.com</a> named-pkcs11[4959]: connection to the LDAP server was lost Oct 7 18:38:47 <a href="http://ipa02.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa02.example.com</a> named-pkcs11[4959]: Failed to get initial credentials (TGT) using principal 'DNS/<a href="http://ipa03.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa03.example.com</a>' and keytab 'FILE:/etc/named.keytab' (Keytab contains no suitable keys for DNS/<a href="mailto:ipa03.example.com@EXAMPLE.COM" class="gmail_msg" target="_blank">ipa03.example.com@EXAMPLE.COM</a>) Oct 7 18:38:47 <a href="http://ipa02.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa02.example.com</a> named-pkcs11[4959]: ldap_syncrepl will reconnect in 60 seconds Oct 7 18:39:00 <a href="http://ipa04.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa04.example.com</a> named-pkcs11[4537]: connection to the LDAP server was lost Oct 7 18:39:00 <a href="http://ipa04.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa04.example.com</a> named-pkcs11[4537]: Failed to get initial credentials (TGT) using principal 'DNS/<a href="http://ipa03.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa03.example.com</a>' and keytab 'FILE:/etc/named.keytab' (Keytab contains no suitable keys for DNS/<a href="mailto:ipa03.example.com@EXAMPLE.COM" class="gmail_msg" target="_blank">ipa03.example.com@EXAMPLE.COM</a>) Oct 7 18:39:00 <a href="http://ipa04.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa04.example.com</a> named-pkcs11[4537]: ldap_syncrepl will reconnect in 60 seconds Oct 7 18:39:16 <a href="http://ipa01.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa01.example.com</a> named-pkcs11[15697]: connection to the LDAP server was lost Oct 7 18:39:16 <a href="http://ipa01.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa01.example.com</a> named-pkcs11[15697]: Failed to get initial credentials (TGT) using principal 'DNS/<a href="http://ipa03.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa03.example.com</a>' and keytab 'FILE:/etc/named.keytab' (Keytab contains no suitable keys for DNS/<a href="mailto:ipa03.example.com@EXAMPLE.COM" class="gmail_msg" target="_blank">ipa03.example.com@EXAMPLE.COM</a>) Oct 7 18:39:16 <a href="http://ipa01.example.com" rel="noreferrer" class="gmail_msg" target="_blank">ipa01.example.com</a> named-pkcs11[15697]: ldap_syncrepl will reconnect in 60 seconds -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" class="gmail_msg" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" class="gmail_msg" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div><div dir="ltr">-- </div><div data-smartmail="gmail_signature"><div dir="ltr">Matt Wells Chief Systems Architect RHCA II, RHCVA - #110-000-353 (702) 808-0424 <a>matt.wells@mosaic451.com</a> Las Vegas | Phoenix | Portland Mosaic451.com CONFIDENTIALITY NOTICE: This transmittal is a confidential communication or may otherwise be privileged. If you are not intended recipient, you are hereby notified that you have received this transmittal in error and that any review, dissemination, distribution or copying of this transmittal is strictly prohibited. If you have received this communication in error, please notify this office, and immediately delete this message and all its attachments, if any. <div>1*</div></div></div>