IE Kerberos failure on some machines with CNAME web server (with SPN for host's A record)

Question

It's fairly well known that IE doesn't like to do Kerberos against hosts that are registered in DNS as CNAMEs. What happens is that IE turns around and uses the underlying A record for the host for looking up the Service Principal Name (SPN).

On a test network we are able to get Kerberos working by having the SPN registered for the A record of the host, so that Kerberos authentication happens successfully when accessing the web server via it's CNAME in the browser. Kerberos authentication works properly when directly accessing the web server with the A record host in the URL, but for various reasons that are beyond my control, it is desired to use the CNAME.

On the production network, this same configuration fails though and I can't figure out why. Any thoughts?

This is a java web application using the SPNEGO library - not IIS. Kerberos authentication is working properly in both the test and production networks (and has been confirmed to not fail back to NTLM), but the CNAME access only works in test.

Answer 1

It appears that a key difference is that in the test environment the CNAME is registered in the same domain as the A record (e.g. host.example.com is the A record and alias.example.com is the CNAME).

In the production environment, the CNAME is for a domain that used to be used, but is no longer the preferred domain, which is where the A record is (e.g. prodhost.example.com is the A record and prodalias.example.net is the CNAME).

Supposedly, the example.net DNS zone (along with the example.com DNS zone) is tied to the example.com domain in Active Directory, but we haven't been able to confirm this configuration yet. Certainly Internet Explorer doesn't seem to be believe that they are related, which is why it's not even attempting to do the Kerberos authentication.

Anyone have pointers / thoughts on this?