How to kerberize OD against AD in Snow Leopard

I seem to be having some trouble with this. I have the DNS setup and the server bound to AD, but I can’t seem to find anything on how exactly to kerberize successfully.

I have the following:

engr-vstream2:~ admin$ host $(hostname)
engr-vstream2.austin.utexas.edu has address 146.6.20.67
engr-vstream2:~ admin$ host 146.6.20.67
67.20.6.146.in-addr.arpa is an alias for 67.64-26.20.6.146.in-addr.arpa.
67.64-26.20.6.146.in-addr.arpa domain name pointer engr-vstream2.austin.utexas.edu.
engr-vstream2:~ admin$ dig -x 146.6.20.67

; <<>> DiG 9.6.0-APPLE-P2 <<>> -x 146.6.20.67
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23615
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;67.20.6.146.in-addr.arpa.	IN	PTR

;; ANSWER SECTION:
67.20.6.146.in-addr.arpa. 574	IN	CNAME	67.64-26.20.6.146.in-addr.arpa.
67.64-26.20.6.146.in-addr.arpa.	2583 IN	PTR	engr-vstream2.austin.utexas.edu.

;; Query time: 0 msec
;; SERVER: 128.83.185.40#53(128.83.185.40)
;; WHEN: Fri Feb  5 14:39:33 2010
;; MSG SIZE  rcvd: 110

engr-vstream2:~ admin$ nslookup 146.6.20.67
Server:		128.83.185.40
Address:	128.83.185.40#53

Non-authoritative answer:
67.20.6.146.in-addr.arpa	canonical name = 67.64-26.20.6.146.in-addr.arpa.
67.64-26.20.6.146.in-addr.arpa	name = engr-vstream2.austin.utexas.edu.

Authoritative answers can be found from:

When I click on the Kerberize button and try either diradmin with the server’s realm, that doesn’t work. When I click on the Kerberize button and try an account in our AD domain with the AD realm, that also fails to work.

What exactly do I need to do to get kerberized against AD? Do I need any special permissions in AD and what exactly are they?