Check the SPNs of the client end point inside the wcf configuration file. Make sure that the destination endpoint is defined correctly.
This can be caused by requiring kerberos authentication where is it not possible. In this case make sure that allowntlm is enabled for the particular service.
Keep in mind that Kerberos caches the SPN tickets. Purge them on all machines when making a change to them.
Restart the app pools in IIS and restart the services after doing klist purge.
