There must be a way to verify if domain membership still works
Right now, there is a way to reset the machine account. This is documented to break domain membership. However, there is no easy way to figure out, from a shell script or from command line, that domain membership is in fact broken. I.e. that the tickets from the keytab no longer work.