Actually DNS domain->realm already always defaults to off:


Date: Mon, 02 Jun 2003 17:51:56 -0400
From: Jeffrey Altman <jaltman@columbia.edu>
To: krbcore@mit.edu
Subject: Default DNS REALM lookups in Kerberos 5 tree

The default behavior of DNS REALM lookups in the Kerberos 5 tree is
specified in auth/krb5/src/lib/krb5/os/locate_kdc.c

This behavior is currently to return a consistent default value
specified by the value of DEFAULT_LOOKUP_REALM regardless of whether or
not the krb5.conf file exists.  The behavior I described must have been
removed by Ken Raeburn during the transition from release 1.1 to 1.2. 
The behavior of using a different value for a missing configuration file
continues exist in the Windows Kerberos IV library.  I suggest we leave
things as is until the krb4 merger.