The verification isn't that the name is resolvable, it is that it is owned by the IPA domain.

The problem with relyong on external DNS is there is no proof that you own the SAN. What is to prevent a user from getting a SAN for www.google.com and creating a man-in-the-middle?

First, I understand what you mean.

In my company DNS is unfortunately apart from the IPA so when I want to secure communications I now cannot use freeipa for this. My application needs the ip address SAN.

Is a custom override possible for this security reason?
Or can an override be implemented?

Maybe add a special configuration for company trusted DNS servers?

We could implement a feature whereby administrators could configure alternative "canonical"/"trustworthy" DNS sources to use for CSR ipAddressName validation.
But this would be a significant engineering effort. And there is no simple way to bypass
or override the current behaviour.

@lvg an alternative approach would be to issue a sub-CA certificate (i.e. for a private key that is outside of Dogtag/FreeIPA), and use that CA to issue the IP address certificates.

As adding functionality to FreeIPA is a significant effort, so adding a sub-CA is. FreeIPA support (almost) all we need and we do not need more to manage and maintain.
As a test I bypassed the code to verify the consistency of the SAN and that works as expected. I think that implementing a trustworthy DNS source is preferable.
Also other users will like that I suppose. DNS is not always in Linux Administrators hands but in the hands of Network Administrators , mostly not willing to use FreeIPA for that....

@ftweedal Would Certificate Transparency help with the verification?

@amyra CT doesn't help here.