When running dcdiag.exe from the Windows Support Tools against a x64 domain controller, make sure you are running the x64 version of dcdiag.exe. If you try to run the x86 version of dcdiag remotely against an x64 domain controller, the tool may report errors when there really isn’t anything wrong. In my case, I could not get the x64 domain controller to pass the Kerberos and DNS tests when running dcdiag.exe against it from a remote x86 server; however, when I installed the x64 version of the support tools locally on the domain controller, everything passed without error.