diff --git a/services/univention-samba4/98univention-samba4-dns.inst b/services/univention-samba4/98univention-samba4-dns.inst
index 053754a..6b5750f 100644
--- a/services/univention-samba4/98univention-samba4-dns.inst
+++ b/services/univention-samba4/98univention-samba4-dns.inst
@@ -61,10 +61,10 @@ if [ "$samba4_role" != "RODC" ]; then
 	/usr/share/univention-samba4/scripts/create_spn_account.sh \
 		--samaccountname "dns-$hostname" \
 		--serviceprincipalname "DNS/$hostname.$domainname" \
-		--privatekeytab dns.keytab
+		--privatekeytab dns.keytab || die
 fi
 
-update_nss_group_cache
+update_nss_group_cache || die
 
 # Reset NTACLs after the connector has synced the accounts
 if [ $JS_LAST_EXECUTED_VERSION -lt 1 ]; then
@@ -129,17 +129,17 @@ if [ $JS_LAST_EXECUTED_VERSION -le 1 ]; then
 
 		if [ "$s4connectorservicedcs" = "$hostname" ]; then
 
-			/usr/share/univention-samba4/scripts/setup-dns-in-ucsldap.sh "$@" --dc --gc --pdc "$site"
+			/usr/share/univention-samba4/scripts/setup-dns-in-ucsldap.sh "$@" --dc --gc --pdc "$site" || die
 
 		else
 
-			/usr/share/univention-samba4/scripts/setup-dns-in-ucsldap.sh "$@" --dc "$site"
+			/usr/share/univention-samba4/scripts/setup-dns-in-ucsldap.sh "$@" --dc "$site" || die
 
 		fi
 
 	elif [ "$samba4_role" = "RODC" ]; then
 
-		/usr/share/univention-samba4/scripts/setup-dns-in-ucsldap.sh "$@" --rodc "$site"
+		/usr/share/univention-samba4/scripts/setup-dns-in-ucsldap.sh "$@" --rodc "$site" || die
 
 	fi
 
@@ -148,7 +148,7 @@ fi
 # On a selective replicated DC the local system is not registered in global
 # SRV records. But the local settings are required, so execute samba_dnsupdate
 if is_ucr_true samba4/join/dnsupdate; then
-	samba_dnsupdate --local
+	samba_dnsupdate --local || die
 fi
 
 joinscript_save_current_version