DNS forward policy fields were using mutually exclusive checkboxes. Such behavior is unusual for users. Checkboxes were changed to radios. https://fedorahosted.org/freeipa/ticket/2599