If you do a net ads join without any other parameters, the credential that'll work is the PONTUS$ cred, not the others.
So "kinit -k PONTUS$" should work.
Always the same story - people get confused by the UPN (User Principal Name) and SPN (Service Principal Name) meaning. We should write it down somewhere using bold letters so everyone knows....
Ondrej