When you are adding Mailbox Server's to an existing DAG the interface throws the very unhelpful error "The authentication services is unknown". In my environment I have a dedicated Replication network for DAG traffic, and the fix for me was to make sure the bind order was set to MAPI network first, ensuring the Replication network was last.
Rebooted the Mailbox Servers was good measure, tried again and it worked.
