The SPN is not registered on the KDC (usually %2). Check that the SPN is registered on at least one other server besides ...

(1) - The SPN is not registered on the KDC (usually %2).  Check that the SPN is registered  on at least one other server besides %1, and that replication is progressing between this server and the KDC.  The tool repadmin/syncall can be used for this purpose.
 (2) - This server could be a deleted server (and deleted DSA object), and this deletion has not replicated across the enterprise yet.  This will rectify itself within the general replication latency plus the latency of the KCC.  Should be less than a day.
 (3) - It's possible that this server was reclaimed, but it's DSA object was not deleted and an old DNS record representing the server is present.  This can result in this error for the duration of a DNS record lease.  Often about 2 weeks.  To fix this, please clean up the DSA's metadata with ntdsutil.
 (4) - Finally, it's possible that this server has acquired a new IP address, the server's old IP address has been reused, and DNS hasn't been updated to reflect the new IP address. If this problem persists, stop and restart the "Net Logon" service on %1, and delete the old DNS record.