I have a webapp teamsites.servername which uses ntlm as authentication method. I extended this to Intranet zone with a url http://teamsites.mycompany.com and I want to set this to use Kerberos for authentication. teamsites.mycompany.com is an A Record in the DNS and I added teamsites.mycompany.com as SPN to the app pool account. The app pool account also has teamistes.servername and the corresponding fqdn as SPN. But Kerberos authentication fails for teamsites.mycompany.com, it throws error_code: KRB5KRB_AP_ERR_MODIFIED (41).

I figured it out. I had to add the spn HTTP/teamsites.mycompany.com to the servername as well/