Otdfbt

$ umount -a:
Linux server01 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu Nov 29 14:49:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

I am able to successfully mount a DFS file share using the following command:

$ sudo mount.cifs \\domain.com\share /mnt/share -o username=user

$ mount | grep domain
\domain.comshare on /mnt/share type cifs (rw,relatime,vers=default,cache=strict,username=user,domain=,uid=0,noforceuid,gid=0,noforcegid,addr=10.0.0.10,file_mode=0755,dir_mode=0755,soft,nounix,serverino,mapposix,rsize=1048576,wsize=1048576,echo_interval=60,actimeo=1)

here's an output from DFSutil.exe on windows showing the valid referrals:

C:/> dfsutil /pktinfo
Entry: domain.comshare
ShortEntry: domain.comshare
Expires in 260 seconds
UseCount: 0 Type:0x8081 ( REFERRAL_SVC DFS FAILBACK_ENABLED )
 0:[DFS-02Share] AccessStatus: 0 ( ACTIVE TARGETSET )
 1:[DFS-01Share] ( TARGETSET )

If I simulate a failure of the primary server (10.0.0.10), I am not able to mount the share, even though the second referral is valid. I've included the verbose command output:

sudo iptables -I OUTPUT -j DROP -d DFS-02.domain.com
sudo mount.cifs \\domain.com\share /mnt/share -o username=user --verbose
Password for user@domain.comshare: *****
mount.cifs kernel mount options: ip=10.0.0.4,unc=\domain.comshare,user=user,pass=********
mount error(115): Operation now in progress
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
sudo tail /var/log/messages
May 30 11:50:52 server01 kernel: CIFS VFS: BAD_NETWORK_NAME: \domain.comshare

10.0.0.4 is my DC. I can manually force a switch by re-prioritizing DFS referrals on the windows side, but the point of our DFS here is to automatically roll over to a valid server. The windows clients are able to do this by default. We recently had one of the DFS servers go down, causing more issues than we expected.

Is there a configuration or package for cifs I probably missed? Do DFS referrals work correctly on other flavors?

Not a duplicate of this 2013 question, which has no answer and references a broken link. Doesn't seem related to older issues where older keyutils (<1.5) dns_resolver entries needed to be added to use cifs.upcall.