Um.  We're still not enabling KDC DNS lookups by default on Windows?
Is there a reason for that?

Ken