Kerberos SSO across External trust

In WireShark you should see APM communicate first with the local KDC (CONTOSO.LOCAL), initial AS_REQ/REP and then a TGS_REQ to the other realm. The local KDC issues an inter-realm TGT that APM uses to communicate directly with the remote realm. So you should see APM start talking directly to EXAMPLE.LOCAL, and send the inter-realm TGT in a TGS_REQ. Where in this process do you see the server principal unknown message? Can APM resolve and communicate with the KDC in EXAMPLE.LOCAL?