diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index d76ec0551..d75385080 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -310,8 +310,6 @@ def main():
 
     install_krb(config)
     install_http(config)
-    if options.setup_dns:
-        install_bind(config)
     if CA:
         CA.import_ra_cert(dir + "/ra.p12")
         CA.fix_ra_perms()
@@ -344,6 +342,9 @@ def main():
     service.restart("dirsrv")
     service.restart("krb5kdc")
 
+    if options.setup_dns:
+        install_bind(config, options)
+
     # Call client install script
     try:
         ipautil.run(["/usr/sbin/ipa-client-install", "--on-master", "--unattended", "--domain", config.domain_name, "--server", config.host_name, "--realm", config.realm_name])
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install
index 2c890b4e8..03ee6f46b 100755
--- a/install/tools/ipa-server-install
+++ b/install/tools/ipa-server-install
@@ -633,14 +633,6 @@ def main():
         fd.write("enable_ra=True\n")
     fd.close()
 
-    # Create a BIND instance
-    bind = bindinstance.BindInstance(fstore, dm_password)
-    bind.setup(host_name, ip_address, realm_name, domain_name, dns_forwarders)
-    if options.setup_dns:
-        bind.create_instance()
-    else:
-        bind.create_sample_bind_zone()
-
     # Apply any LDAP updates. Needs to be done after the configuration file
     # is created
     service.print_msg("Applying LDAP updates")
@@ -653,6 +645,14 @@ def main():
     service.print_msg("restarting the KDC")
     krb.restart()
 
+    # Create a BIND instance
+    bind = bindinstance.BindInstance(fstore, dm_password)
+    bind.setup(host_name, ip_address, realm_name, domain_name, dns_forwarders)
+    if options.setup_dns:
+        bind.create_instance()
+    else:
+        bind.create_sample_bind_zone()
+
     # Set the admin user kerberos password
     ds.change_admin_password(admin_password)