dns_canonicalize_hostname = fallback

krb5.conf

@@ -15,6 +15,7 @@ includedir /etc/krb5.conf.d/
     rdns = false
     pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
     spake_preauth_groups = edwards25519
+    dns_canonicalize_hostname = fallback
 #    default_realm = EXAMPLE.COM
 
 [realms]

krb5.spec

@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.18.2
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 2%{?dist}
+Release: 3%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz
@@ -632,6 +632,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Tue May 26 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-3
+- dns_canonicalize_hostname = fallback
+
 * Tue May 26 2020 Robbie Harwood <rharwood@redhat.com> - 1.18.2-2
 - Pass channel bindings through SPNEGO