Example: The hostname of the Samba server is host.dom.washington.edu and it is 
joined to the domain windom.washington.edu. When trying to access files using
\\host.dom.washington.edu\service it fails.  It fails because the service 
principals are in the wrong name.

'net ads status' shows that 'net ads join' had generated service principals:

  servicePrincipalName: CIFS/host.windom.washington.edu
  servicePrincipalName: CIFS/host
  servicePrincipalName: HOST/host.windom.washington.edu
  servicePrincipalName: HOST/host

The problem:  The DNS name or name being used to access the host must agree 
with the service principal name. Windows servers don't act like this.  We 
currently have Windows and Samba servers in several DNS domains joined to a 
single Windows domain.  Kerberos principals work out right so they can be 
accessed with their DNS name.  I suggest that this is a bug and that service 
principals (at least CIFS) be generated using the hostname of the host rather 
than taking liberties by chopping the name and appending the domain it is 
joining.