The krb4 APIs do not honor dns_fallback libdefault. For example, krb_get_krbhst() makes dns SRV record requests regardless of the value of dns_fallback in the libdefaults section of the configuration file. This is a problem if the reason you are trying to use "dns_fallback = no" is to avoid using a busted res_ninit() .... :-)