The incremental propagation code can fail if either: * The configured default realm does not match the realm being propagated (even if the -r option is used to specify a realm) * The slave hostname has a configured mapping for a different realm than the realm being propagated. These problems chiefly arise from the use of krb5_sname_to_principal() in kprop and kpropd. See also this thread: http://mailman.mit.edu/pipermail/kerberos/2015-November/021025.html