diff --git a/roles/ipaclient/defaults/main.yml b/roles/ipaclient/defaults/main.yml
index 5a6eea64..2e2e59ac 100644
--- a/roles/ipaclient/defaults/main.yml
+++ b/roles/ipaclient/defaults/main.yml
@@ -6,3 +6,4 @@ ipaclient_ntp: no
 ipaclient_mkhomedir: no
 ipaclient_kinit_attempts: 5
 ipaclient_use_otp: "false"
+ipaclient_allow_repair: "false"
diff --git a/roles/ipaclient/tasks/install.yml b/roles/ipaclient/tasks/install.yml
index 32fea856..4280879b 100644
--- a/roles/ipaclient/tasks/install.yml
+++ b/roles/ipaclient/tasks/install.yml
@@ -100,6 +100,13 @@
   register: ipajoin
   when: not ipatest.krb5_keytab_ok
 
+- block:
+  - file:
+      path: "/etc/ipa/.dns_ccache"
+      state: absent
+  - meta: end_play
+  when: not ipaclient_allow_repair | bool and (ipatest.krb5_keytab_ok or ipajoin.already_joined)
+
 - name: Install - Configure IPA default.conf
   include_role:
     name: ipaconf