When AD forest A has a trust with a forest B that claims ownership of a domain name (TLN) owned by an IPA forest, we need to build exclusion record for that specific TLN, not our domain name. Use realmdomains to find a correct exclusion entry to build. Fixes: https://pagure.io/freeipa/issue/7370 Reviewed-By: Armando Neto <abiagion@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>