diff --git a/prole-dns/init-prole-dns.sh b/prole-dns/init-prole-dns.sh
index a3894fd..e2710f4 100644
--- a/prole-dns/init-prole-dns.sh
+++ b/prole-dns/init-prole-dns.sh
@@ -202,7 +202,17 @@ samba_add_rr() {
     log "[DRY_RUN] samba-tool dns add $dc $zone $name $rrtype $value --use-kerberos=required"
     return 0
   fi
-  samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" --use-kerberos=required
+  local out
+  if out=$(samba-tool dns add "$dc" "$zone" "$name" "$rrtype" "$value" --use-kerberos=required 2>&1); then
+    return 0
+  else
+    if [[ "$out" == *"WERR_DNS_ERROR_RECORD_ALREADY_EXISTS"* ]]; then
+      log "INFO: Record $name $rrtype $value already exists (ignored error)"
+      return 0
+    fi
+    echo "$out" >&2
+    return 1
+  fi
 }
 
 samba_update_rr() {
@@ -211,7 +221,17 @@ samba_update_rr() {
     log "[DRY_RUN] samba-tool dns update $dc $zone $name $rrtype $old $new --use-kerberos=required"
     return 0
   fi
-  samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" --use-kerberos=required
+  local out
+  if out=$(samba-tool dns update "$dc" "$zone" "$name" "$rrtype" "$old" "$new" --use-kerberos=required 2>&1); then
+    return 0
+  else
+    if [[ "$out" == *"WERR_DNS_ERROR_RECORD_ALREADY_EXISTS"* ]]; then
+      log "INFO: Record $name $rrtype $new already exists (ignored error)"
+      return 0
+    fi
+    echo "$out" >&2
+    return 1
+  fi
 }
 
 sync_rr_set() {
@@ -401,18 +421,28 @@ cmd_sync() {
   # Verify Kerberos ticket if running as root via sudo (common case)
   if [[ -z "${KRB5CCNAME:-}" ]]; then
     if [[ -n "${SUDO_UID:-}" ]]; then
-      local candidate="FILE:/tmp/krb5cc_${SUDO_UID}"
-      if [[ -f "${candidate#FILE:}" ]]; then
-        export KRB5CCNAME="$candidate"
-        log "INFO: Automatically using Kerberos cache from sudoer: $KRB5CCNAME"
+      local user_candidate="FILE:/tmp/krb5cc_${SUDO_UID}"
+      if [[ -f "${user_candidate#FILE:}" ]]; then
+        # Try to use it, but if it's not readable by root (Operation not permitted),
+        # we might need to tell the user to kinit as root or fix permissions.
+        if [[ -r "${user_candidate#FILE:}" ]]; then
+          export KRB5CCNAME="$user_candidate"
+          log "INFO: Automatically using Kerberos cache from sudoer: $KRB5CCNAME"
+        else
+          log "WARN: Found Kerberos cache at ${user_candidate}, but it is not readable by root. Try: sudo kinit administrator@${AD_DNS_ZONE^^}"
+        fi
       fi
     fi
   fi
 
+  # If KRB5CCNAME is set but not readable, it will fail later.
+  if [[ -n "${KRB5CCNAME:-}" && ! -r "${KRB5CCNAME#FILE:}" ]]; then
+     log "WARN: Kerberos cache ${KRB5CCNAME} is not readable by current user ($(id -u)). samba-tool will likely fail."
+     log "HINT: Try running 'kinit' as root, or use 'sudo kinit administrator@${AD_DNS_ZONE^^}'"
+  fi
+
   if [[ -z "${KRB5CCNAME:-}" ]]; then
     log "WARN: KRB5CCNAME is not set. If samba-tool fails, try running with: sudo -E $0 sync"
-  elif [[ ! -f "${KRB5CCNAME#FILE:}" ]]; then
-     log "WARN: Kerberos cache ${KRB5CCNAME} not found. samba-tool might fail."
   fi
 
   local exit_code=0
@@ -516,6 +546,7 @@ Host list sources:
 
 Examples:
   sudo $0 sync
+  sudo kinit administrator@PROLE.ORG && sudo $0 sync
   sudo -E $0 sync (preserves Kerberos ticket environment)
   sudo DRY_RUN=1 $0 sync
   sudo $0 start