Use tkey-gssapi-keytab in named.conf
    
    Remove obsolete BIND GSSAPI configuration options tkey-gssapi-credential
    and tkey-domain and replace them with tkey-gssapi-keytab which avoids
    unnecessary Kerberos checks on BIND startup and can cause issues when
    KDC is not available.
    
    Both new and current IPA installations are updated.
    
    https://fedorahosted.org/freeipa/ticket/3429