For using kerberos authentication, you need to configure your domain this way:
zmprov md
zimbraAuthKerberos5Realm zimbraAuthMech kerberos5
For POP/IMAP using kerberos, you need to put pop/imap service ketyab in /opt/zimbra/conf/krb5.keytab. Zimbra user needs to be able to read it.
You also need "unrestricted java policy jar", from Java SE Downloads. The two jar files replace Zimbra's packaged jar files under /opt/zimbra/java/jre/lib/security/.
For me, I am looking for the instructions to use SASL/GSSAPI to bind to an external LDAP server for GAL information.. The domain configuration on console seem only allow binding with a password or anonymous.