Did you open a ticket? I did a network capture and it's trying to do a srv lookup on .mil (don't have it handy, it was actually on another network). I tried to compare krb5.conf from vCenter 6.5 and 6.7 and the differences weren't in there. So I don't think it'll get fixed without a ticket. I am unsure if before it actually checked the alternative UPNs in AD or just sent everything to the default realm, but this is definitely a show stopper for 6.7 for us.