This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/893

Right now, the dynamic DNS update message is not logged anywhere. I suspect that the reason for not including it were security concerns.

I think the message should be logged, because the logs are readable by root only anyway and moreover the update message only contains the following data:

 * hostname of the client
 * IP addresses of clients's network interface (either the one the client uses to connect to LDAP or one selected in the sssd config file)
 * client DNS zone
 * Kerberos realm of the client
 * IPA server hostname

Adding the full nsupdate message would help in debugging dyndns issues as it would be possible to use the same message directly with nsupdate from the command line.