Realm domain list can contain a rogue domain - a domain controlled by AD. Trust won't work in that case. It can happen if a host which belongs to AD domain is added to IPA server, see #4798

IPA server should perform a check whether it contains such domain before establishing trust.

This check is limited for the case where trust is establish using shared secret because ipa lacks credentials to ask AD for list of its domains. Thus the only thing known, which should be checked, is the forest root DNS domain.