In an explicit proxy deployment, the client sends a Kerberos request, which contains a service principal name (SPN), to the Key Distribution Center (KDC). When the KDC receives the request, it either returns a service ticket or an error message to the client. The KDC returns a service ticket if the SPN is valid and an error message if the SPN is invalid.
To verify if the SPN is valid for a client in an explicit proxy deployment:
Verify that the browser is configured with the correct hostname.
In the CLI, enter the following command to clear the ticket cache: