Planning and running DNS for FreeIPA: domain and realm naming, integrated versus external DNS, forwarding, delegation, reverse zones, zone transfers and DNSSEC.
Naming a FreeIPA deployment so it never needs renaming: an own primary DNS domain, realm as the uppercase domain, avoiding overlaps with AD, not inventing top-level domains, and why DNS views are discouraged.
Deciding whether FreeIPA serves DNS itself: automatic SRV and ipa-ca records, client dynamic updates, the split DNS limitation, IP address SANs, and what an external DNS team must maintain instead.
Configuring global forwarders and per-domain forward zones in FreeIPA DNS: forward first versus forward only, configuration priority, and forwarding to Active Directory or corporate DNS.
Delegating ipa.example.com from the corporate DNS to FreeIPA name servers: NS records in the parent zone, repeating delegation for every new FreeIPA DNS server, and testing resolution.
Setting up reverse DNS in FreeIPA: why installs need forward and reverse resolution, creating reverse zones, syncing PTR records with A and AAAA records, and one PTR per IP.
Sharing FreeIPA zones with secondary DNS servers: transfers disabled by default, AXFR and IXFR, allow-transfer settings, and pointing secondaries at one IdM server because SOA serials differ between servers.
What DNSSEC support in FreeIPA means today: validation enabled by default at install, zone signing as a Technology Preview in RHEL IdM, and when to sign zones elsewhere.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.