You need to prevent the sales.contoso.com and the manufacturing.contoso.com names from being used in authentication requests across the forest trust