Why the reverse DNS lookup of SPN during initial phase of Kerberos authentication?

I've always assumed it's to break CNAMES.