`net ads join` dNSname change went into 4.10, and subsequently CentOS 7.8.2003 which results in an invalid value on the object in AD, and incorrect service principals being created on join.
Old behavior, use the system reported fqdn for the dNSname.
New behavior, append the netbios name and the realm.
Although there was a new parameter added to provide a way for "addtional dns names", there are two problems with this approach.
1. An AD model which restricts creating additional principals on join (eg. join only account), doesn't allow these additional principals.
2. Assuming the netbios + realm result in a resolvable dnsname doesn't account for use cases where the system being joined is in a different dns domain.
There doesn't seem to be a way to override this assumption with a parameter.
Results in the incorrect dNSdomain value in the DC object, and host/ service principals that can't be used.
Considering there are options to set the realm, netbios name, and additional dns names, it would seem reasonable to also allow overriding the assumed (default) dnsname?
My specific use case. Satellite offices and dev environments have their own dns domain, but not a local DC or realm, and join the region or head-office DC which may have a different realm and/or dns domain.
Changed with bug 14116
Other possibly related issues with the changes: