We are using the Apache HttpClient library in order to connect to a Kerberos-secured REST endpoint which is behind a load balancer that serves multiple applications, so there is a mismatch between the forward and reverse DNS lookup results.

While we can successfully establish an authenticated session using cURL by setting rdns=false in the krb5.conf file, the same does not seem possible in Java - it is simply ignoring this setting and always performs the reverse DNS lookup, which of course fails the handshake due to the mismatch.

I haven't found too much information regarding this issue, but I did find this open Jira item, which explains the behavior we're seeing.. but does not provide any workaround:
<https://bugs.openjdk.java.net/browse/JDK-8189361>

The only viable workaround I've found so far is to use a custom nameservice provider to "hijack" the reverse DNS lookups and return the desired hostname.  

There is also very scarce information on this, but I found this blogpost from almost 12 years ago that still seems to work (although it feels like a pretty dirty hack):  

<http://rkuzmik.blogspot.co.il/2006/08/local-managed-dns-java_11.html>

However it feels like I may be missing something here as it seems unlikely that there is so little information about this problem.. 

Has anyone else faced an issue with disabling reverse DNS lookups when doing Kerberos, in Java? If so, how did you resolve this.