Resolve AD Replication SPN Error

My Windows Server 2016 domain controllers have suddenly stopped replicating. Every repadmin /showrepl run ends with “The Target Principal Name is incorrect,” and corresponding Kerberos errors crowd the event logs. No server-side or network changes were made recently, so the culprit is likely an unnoticed SPN, DNS, time-sync, or authentication mismatch.

Goal
Pinpoint the exact root cause and restore healthy, bidirectional Active Directory replication on Windows Server 2016.

Deliverables
• Real-time troubleshooting session (PowerShell, repadmin, dcdiag, ADS&S, setspn, etc.) until replication reports zero failures
• Plain-language explanation of the issue, its fix, and preventive notes
• Step-by-step record or script so I can repeat the remedy if the error resurfaces

Replication must pass at least one complete cycle with no errors in Repadmin and Event Viewer before the task is considered finished. Any critical action—SPN cleanup, time service tweaks, metadata cleanup, role seizure, DNS adjustments—should be discussed with me first. Remote access details and testing windows (UTC-5) can be arranged immediately.