Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's fairly well known that IE doesn't like to do Kerberos against hosts that are registered in DNS as CNAMEs. What happens is that IE turns around and uses the underlying A record for the host for looking up the Service Principal Name (SPN).

On a test network we are able to get Kerberos working by having the SPN registered for the A record of the host, so that Kerberos authentication happens successfully when accessing the web server via it's CNAME in the browser. Kerberos authentication works properly when directly accessing the web server with the A record host in the URL, but for various reasons that are beyond my control, it is desired to use the CNAME.

On the production network, this same configuration fails though and I can't figure out why. Any thoughts?

This is a java web application using the SPNEGO library - not IIS. Kerberos authentication is working properly in both the test and production networks (and has been confirmed to not fail back to NTLM), but the CNAME access only works in test.

share|improve this question

It appears that a key difference is that in the test environment the CNAME is registered in the same domain as the A record (e.g. is the A record and is the CNAME).

In the production environment, the CNAME is for a domain that used to be used, but is no longer the preferred domain, which is where the A record is (e.g. is the A record and is the CNAME).

Supposedly, the DNS zone (along with the DNS zone) is tied to the domain in Active Directory, but we haven't been able to confirm this configuration yet. Certainly Internet Explorer doesn't seem to be believe that they are related, which is why it's not even attempting to do the Kerberos authentication.

Anyone have pointers / thoughts on this?

share|improve this answer
One of our developers realized that the secondary domain was not set for replication. Once that was turned on, then the Kerberos authentication with the CNAME started working properly. – Eric Thames Mar 8 '11 at 20:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.