It should be possible to use wildcard addresses with Kerberos enable (dropping use of _HOST)