KerberosName has a static initialization block that looks up the default realm. Running with Oracle JDK7, this code path triggers a DNS query. In some environments, we've seen this DNS query block and time out after 30 seconds. This is part of static initialization, and the class is referenced from UserGroupInformation#initialize, so every daemon and every shell command experiences this delay. This occurs even for non-secure deployments, which don't need the default realm.