We should probably add trailing dots to the hostnames in krb5.conf. And anywhere in the code where we construct hostnames, like "kerberos."+realmname.