VPN Problem: Kerberos & Mail Service

Question

We're having a problem with our new deployment of Leopard Server. We have successfully set up a bunch of services, but are having two problems.
1. Kerberos Authentication
When we select kerberos as the authentication method, authentication fails with the error "cannot contact any kdc for requested realm" all other uses of Kerberos on the network work without a hitch. Any tips to point us in the right direction to troubleshoot. We can connect our users just fine with the MS-CHAPv2 method.
2. Email SMTP sending
We have enabled only SMTP relays for local hosts on our network, but my hope was that when connected via VPN users would be able to send using our SMTP servers. We will have lots of users who will be 90%+ "off" the network and connected only with VPN, so we need to figure out a way for them to be able to send emails.
Any thoughts, I searched but couldnt find what I was looking for.

Answer 1

1. As I understand it the KDC must be reachable BEFORE you try connecting to your LAN using VPN if using Kerberos as the authentication method.
2. Should work if using internal DNS (or IP number in Mail for SMTP server address) in VPN config so the client can find the SMTP server through the VPN. Or should work if authenticating SMTP(s) and/or if using other port for "submission" of mail.
Some ISPs and others block outgoing SMTP on port 25 and force you to go through their SMTP relay or allow Webmail only.
If authenting VPN using some other method you can use the Kerberos application manually afterwards when connected to login/authenticate to the KDC for other services.
Machines are connected to OD "hard" (show up as machine records in OD)?