If they are using AD, they are using Kerberos by default. I think that was pretty much answered in your other question. However, also by default, if Kerberos is blocked or failing, the systems will fail back to NTLM unless that is disabled via GPO - which it should be, it's recommended.
You could also fire up Wireshark and sniff the network traffic and see what protocols are going out during authentication.
If you're having problems make your application work with some AD domains and not others, have you set up a test lab? If this is for a commercial product, maybe it would be worth your company's time and money to actually hire or contract an MCSE / MCITP to come in and set up the lab and do some compatibility testing with you?
I don't want to discourage you from asking questions here, but it might be better if you explained a full scenario of what you're doing, what you're expecting and what is actually happening. A full detailed big-picture view - more details than a simplified overview, but more general than asking for one small piece of information.