Woops. I should point out that this: > [domain_realm] > .agkn.net = KRBTEST > agkn.net = KRBTEST should be this, to match my other examples: [domain_realm] .test.com = KRBTEST test.com = KRBTEST Bit of a sanitization fail there. :)