diff --git a/roles/ipaclient/defaults/main.yml b/roles/ipaclient/defaults/main.yml
index 5a6eea644a190feb010e043ca5c7bf090bfc7e2e..2e2e59ac8bd642db9c35c082ccc6282ab0e2c2f7 100644
--- a/roles/ipaclient/defaults/main.yml
+++ b/roles/ipaclient/defaults/main.yml
@@ -6,3 +6,4 @@ ipaclient_ntp: no
 ipaclient_mkhomedir: no
 ipaclient_kinit_attempts: 5
 ipaclient_use_otp: "false"
+ipaclient_allow_repair: "false"
diff --git a/roles/ipaclient/tasks/install.yml b/roles/ipaclient/tasks/install.yml
index 32fea856cd9c0b7d7ce2aa380445ba2ad67d00ec..4280879b24cfde955cc7a660bf36b8fc224d7727 100644
--- a/roles/ipaclient/tasks/install.yml
+++ b/roles/ipaclient/tasks/install.yml
@@ -100,6 +100,13 @@
   register: ipajoin
   when: not ipatest.krb5_keytab_ok
 
+- block:
+  - file:
+      path: "/etc/ipa/.dns_ccache"
+      state: absent
+  - meta: end_play
+  when: not ipaclient_allow_repair | bool and (ipatest.krb5_keytab_ok or ipajoin.already_joined)
+
 - name: Install - Configure IPA default.conf
   include_role:
     name: ipaconf