diff --git a/test/manual/kerberos.test.js b/test/manual/kerberos.test.js
index f269a247c46..a88aed4f053 100644
--- a/test/manual/kerberos.test.js
+++ b/test/manual/kerberos.test.js
@@ -122,6 +122,60 @@ describe('Kerberos', function () {
     }
 
     context('when the value is forwardAndReverse', function () {
+      context('when the forward lookup is empty', function () {
+        const lookupStub = (address, callback) => {
+          callback(null, []);
+        };
+
+        beforeEach(function () {
+          dns.lookup.restore();
+          sinon.stub(dns, 'lookup').callsFake(lookupStub);
+        });
+
+        it('authenticates with a fallback cname lookup', function (done) {
+          const client = new MongoClient(
+            `${krb5Uri}&authMechanismProperties=SERVICE_NAME:mongodb,CANONICALIZE_HOST_NAME:forwardAndReverse&maxPoolSize=1`
+          );
+          client.connect(function (err, client) {
+            if (err) return done(err);
+            // 2 calls to establish connection, 1 call in canonicalization.
+            expect(dns.lookup).to.be.calledThrice;
+            // This fails.
+            expect(dns.resolvePtr).to.not.be.called;
+            // Expect the fallback to be called.
+            expect(dns.resolveCname).to.be.calledOnce;
+            verifyKerberosAuthentication(client, done);
+          });
+        });
+      });
+
+      context('when the forrward lookup fails', function () {
+        const lookupStub = (address, callback) => {
+          callback(new Error('not found'), null);
+        };
+
+        beforeEach(function () {
+          dns.lookup.restore();
+          sinon.stub(dns, 'lookup').callsFake(lookupStub);
+        });
+
+        it('authenticates with a fallback cname lookup', function (done) {
+          const client = new MongoClient(
+            `${krb5Uri}&authMechanismProperties=SERVICE_NAME:mongodb,CANONICALIZE_HOST_NAME:forwardAndReverse&maxPoolSize=1`
+          );
+          client.connect(function (err, client) {
+            if (err) return done(err);
+            // 2 calls to establish connection, 1 call in canonicalization.
+            expect(dns.lookup).to.be.calledThrice;
+            // This fails.
+            expect(dns.resolvePtr).to.not.be.called;
+            // Expect the fallback to be called.
+            expect(dns.resolveCname).to.be.calledOnce;
+            verifyKerberosAuthentication(client, done);
+          });
+        });
+      });
+
       context('when the reverse lookup succeeds', function () {
         const resolveStub = (address, callback) => {
           callback(null, [host]);