diff --git a/lib/krb5/sock_principal.c b/lib/krb5/sock_principal.c
index a43546de3..aedb0cf46 100644
--- a/lib/krb5/sock_principal.c
+++ b/lib/krb5/sock_principal.c
@@ -46,6 +46,14 @@ krb5_sock_to_principal (krb5_context context,
     socklen_t salen = sizeof(__ss);
     char hostname[NI_MAXHOST];
 
+    if (krb5_config_get_bool(context, NULL, "libdefaults", "block_dns",
+	    NULL)) {
+	ret = HEIM_EAI_FAIL;
+	krb5_set_error_message (context, ret,
+				"krb5_sock_to_principal: block_dns enabled");
+	return ret;
+    }
+
     if (getsockname (sock, sa, &salen) < 0) {
 	ret = errno;
 	krb5_set_error_message (context, ret, "getsockname: %s", strerror(ret));