The SPN is not registered on the KDC (usually %2). Check that the SPN is registered on at least one other server besides ...

(1) - The SPN is not registered on the KDC (usually %2).  Check that the SPN is registered 
on at least one other server besides %1, and that replication is progressing between this
server and the KDC.  The tool repadmin/syncall can be used for this purpose.

(2) - This server could be a deleted server (and deleted DSA object), and this deletion
has not replicated across the enterprise yet.  This will rectify itself within the general
replication latency plus the latency of the KCC.  Should be less than a day.

(3) - It's possible that this server was reclaimed, but it's DSA object was not deleted
and an old DNS record representing the server is present.  This can result in this error
for the duration of a DNS record lease.  Often about 2 weeks.  To fix this, please
clean up the DSA's metadata with ntdsutil.

(4) - Finally, it's possible that this server has acquired a new IP address, the server's
old IP address has been reused, and DNS hasn't been updated to reflect the new IP address.
If this problem persists, stop and restart the "Net Logon" service on %1, and delete the
old DNS record.