I know one can disable the reverse DNS lookup made by individual client applications when calculating SPN of the called server during Kerberos authentication. There are various ways, e. g.:
- In Java: Java + Kerberos - disable reverse DNS lookup.
- When using the MIT Kerberos implementation: Principal names and DNS - search for
rdns = false
.
My question is whether this can be somehow achieved on a Windows (namely Windows 10) client machine globally - for all applications. The following variants don't seem to be a solution:
- Tell Windows not to do the reverse lookup. I checked MS Kerberos registry documentation and I cannot see such a setting there.
- Tell Windows / all applications in Windows to use the MIT implementation instead. There seem to be special settings e. g. in PuTTY or Firefox which enable choosing a concrete GSSAPI/Kerberos implementation. But what about the other applications, like Chrome or the Windows network disks mapper?
- Highly theoretical and not practical: Change, recompile and deploy the hard-wired part of Windows responsible for the lookup.