diff --git a/mozilla/extensions/auth/nsAuthSSPI.cpp b/mozilla/extensions/auth/nsAuthSSPI.cpp
index 6a6de9250d0..2fe0a07ed75 100644
--- a/mozilla/extensions/auth/nsAuthSSPI.cpp
+++ b/mozilla/extensions/auth/nsAuthSSPI.cpp
@@ -246,9 +246,24 @@ nsAuthSSPI::Init(const char *serviceName,
     SEC_CHAR *package;
 
     package = (SEC_CHAR *) pTypeName[(int)mPackage];
-    rv = MakeSN(serviceName, mServiceName);
-    if (NS_FAILED(rv))
-        return rv;
+
+    if (mPackage == PACKAGE_TYPE_NTLM) {
+        // (bug 535193) For NTLM, just use the uri host, do not do canonical host lookups.
+        // The incoming serviceName is in the format: "protocol@hostname", SSPI expects
+        // "<service class>/<hostname>", so swap the '@' for a '/'.
+        mServiceName.Assign(serviceName);
+        PRInt32 index = mServiceName.FindChar('@');
+        if (index == kNotFound)
+            return NS_ERROR_UNEXPECTED;
+        mServiceName.Replace(index, 1, '/');
+    }
+    else {
+        // Kerberos requires the canonical host, MakeSN takes care of this through a
+        // DNS lookup.
+        rv = MakeSN(serviceName, mServiceName);
+        if (NS_FAILED(rv))
+            return rv;
+    }
 
     mServiceFlags = serviceFlags;