If you do a net ads join without any other parameters, the credential that'll
work is the PONTUS$ cred, not the others.

So "kinit -k PONTUS$" should work.

Always the same story - people get confused by the UPN (User Principal Name) and SPN (Service Principal Name) meaning.
We should write it down somewhere using bold letters so everyone knows....

Ondrej