diff --git a/TODO b/TODO
index a24a9d094..387d4d089 100644
--- a/TODO
+++ b/TODO
@@ -82,6 +82,10 @@ fix to use rpc?
 
 ** lib/krb5
 
+rewrite the lookup of KDCs to handle kerberos-<n> and not do any DNS
+requests if the information can be found locally.  this requires stop
+using krb5_get_krbhst.
+
 the replay cache is, in its current state, not very useful
 
 the following encryption types have been implemented: DES-CBC-CRC,