diff --git a/CHANGES b/CHANGES
index 8b34a2e625..06f5a1265e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2995.	[bug]		The Kerberos realm was not being correctly extracted
+			from the signer's identity. [RT #22770]
+
 2994.	[port]		NetBSD: use pthreads by default on NetBSD >= 5.0, and
 			do not use threads on earlier versions.  Also kill
 			the unproven-pthreads, mit-pthreads, and ptl2 support.
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 29b2af0a3d..90e8cccba5 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gssapictx.c,v 1.21 2010/12/19 21:32:35 each Exp $ */
+/* $Id: gssapictx.c,v 1.22 2010/12/22 02:33:12 marka Exp $ */
 
 #include <config.h>
 
@@ -363,7 +363,7 @@ dst_gssapi_identitymatchesrealmkrb5(dns_name_t *signer, dns_name_t *name,
 	if (rname == NULL)
 		return (isc_boolean_false);
 	*rname = '\0';
-	rname += 2;
+	rname++;
 
 	/*
 	 * Find the host portion of the signer's name.	We do this by