So I created a Single Web Application: rootsite.contoso.com with a Root Site Collection. I set the Authentication in the Web App to use Kerberos and then Set the SPN for the AppPool account running the Web App with
Checking for Kerberos via Fiddler and it works, wonderful. However, now it seams I have to Add Each Host-Named Site Collection to the same Service Account running the AppPool in order for these sites to render via Kerberos.
Is this correct? I'm concerned first that it's a maintenance issue, and second, that the list of SPN values will get out of hand.