Important Checklist For Configuring IIS authentication with Kerberos

 https://techcommunity.microsoft.com/t5/iis-support-blog/service-principal-name-spn-checklist-for-kerberos-authentication/ba-p/347639

For a single hop, ensure that the SPN is set correctly:

If the application runs with the system account, check it like this:

setspn -L computername 

It should return either HTTP/computername or HTTP/dnsname

The prefix HOST is a "catch all" for HTTP and some others. So it should be OK as well.

If the application pool runs with custom identity (which is a member of a domain), check it with

setspn -L accountname

Then configure in IIS to use application pool credentials or else it won't be able to decrypt Kerberos ticket.