DNS SRV Record Misconfiguration — Common Cause of Kerb eros Authentication Failures

Hello,

I wanted to share some patterns I've observed around DNS-related Kerberos f=
ailures, since DNS misconfiguration remains one of the most common root cau=
ses of "Cannot find KDC for realm" errors.

Kerberos relies on DNS SRV records (_kerberos._udp.REALM, _kerberos._tcp.RE=
ALM) and TXT records (_kerberos.REALM) for KDC discovery. When these are mi=
sconfigured, authentication silently fails =97 often without helpful error =
messages.

Common issues I've seen:

1. Missing SRV records =97 admins configure A records for the KDC but forge=
t the _kerberos._udp and _kerberos-adm._tcp SRV records. Clients fall back =
to broadcast or /etc/krb5.conf and discovery breaks in multi-site setups.

2. TTL too high on SRV records =97 during KDC migration, a 24h TTL on the o=
ld SRV record means clients keep hitting the decommissioned KDC for up to a=
 day. Setting TTL to 300s before migration avoids this.

3. Split-horizon DNS =97 internal vs. external DNS returning different resu=
lts for _kerberos SRV records. Remote/VPN users get the external response a=
nd can't reach the KDC.

4. DNSSEC validation failures =97 if the realm's DNS zone is DNSSEC-signed =
but the validating resolver has a stale trust anchor, SRV lookups fail with=
 SERVFAIL. The Kerberos client just sees "no KDC found=94 with no hint it's=
 a DNSSEC issue.

For diagnosing these, checking the actual DNS responses from the client's p=
erspective is critical =97 the records may look correct from the admin's re=
solver but broken from the client's. Tools like DNS Robot (https://dnsrobot=
.net/dns-lookup) can help verify what different resolvers return for SRV an=
d TXT records globally.

Has anyone else dealt with DNSSEC-related Kerberos failures? Curious if the=
re are best practices for coordinating DNSSEC key rollovers with Kerberos-d=
ependent zones.

Best regards,

Shaik Vahid

DNS Robot =97 https://dnsrobot.net<https://dnsrobot.net/>

Free DNS & Network Diagnostic Tools

________________________________________________
Kerberos mailing list           [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos