Active Directory establishes ownership mapping between an Active Directory domain and a DNS domain where its clients are enrolled. If IPA forest trusts an Active Directory forest and one of IPA clients is enrolled with a DNS domain name belonging to a trusted Active Directory forest, then access to such IPA client from Windows workstations can only be achieved without utilizing Kerberos, as described by https://www.freeipa.org/page/V4/IPA_Client_in_Active_Directory_DNS_domain

In practice, it is a common situation in complex environments. While there are might be reasons to still consider such half-functional enrollment, it would be great if during enrollment process the server side would have warned that a particular DNS domain name of this client is already owned by a trusted Active Directory forest and no Kerberos authentication to services hosted on this client will be possible from any client enrolled into the trusted Active Directory forest's domain.

We also might want to extend IPA healthcheck to make sure we recognize such situation and warn administrators about it.