diff --git a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java
index aa12b93be9..b573234264 100644
--- a/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java
+++ b/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java
@@ -424,7 +424,7 @@ public static InetSocketAddress getTokenServiceAddr(Token<?> token) {
    */
   public static void setTokenService(Token<?> token, InetSocketAddress addr) {
     Text service = buildTokenService(addr);
-    if (token != null) {
+    if (token != null && service != null) {
       token.setService(service);
       if (LOG.isDebugEnabled()) {
         LOG.debug("Acquired token "+token);  // Token#toString() prints service
@@ -444,9 +444,10 @@ public static Text buildTokenService(InetSocketAddress addr) {
     String host = null;
     if (useIpForTokenService) {
       if (addr.isUnresolved()) { // host has no ip address
-        throw new IllegalArgumentException(
-            new UnknownHostException(addr.getHostName())
-        );
+        LOG.warn("unable to resolve host name " + addr
+            + ". Failure to construct a correct token service "
+            + "name may result in operation failures");
+        return null;
       }
       host = addr.getAddress().getHostAddress();
     } else {
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java
index 7076ec674b..e78cee9160 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/ha/TestDelegationTokensWithHA.java
@@ -332,6 +332,29 @@ public void testHAUtilClonesDelegationTokens() throws Exception {
     }    
   }
 
+  @Test(timeout = 300000)
+  public void testHAUtilClonesDTsDomainNameResolvedFail() throws Exception {
+    final Token<DelegationTokenIdentifier> token =
+        getDelegationToken(fs, "JobTracker");
+
+    UserGroupInformation ugi = UserGroupInformation.createRemoteUser("test");
+
+    URI haUri = new URI("hdfs://my-ha-uri/");
+    token.setService(HAUtilClient.buildTokenServiceForLogicalUri(haUri,
+        HdfsConstants.HDFS_URI_SCHEME));
+    ugi.addToken(token);
+
+    Collection<InetSocketAddress> nnAddrs = new HashSet<InetSocketAddress>();
+    nnAddrs.add(new InetSocketAddress("domainname.doesnot.exist",
+        nn0.getNameNodeAddress().getPort()));
+    nnAddrs.add(new InetSocketAddress("localhost",
+        nn1.getNameNodeAddress().getPort()));
+    HAUtilClient.cloneDelegationTokenForLogicalUri(ugi, haUri, nnAddrs);
+
+    Collection<Token<? extends TokenIdentifier>> tokens = ugi.getTokens();
+    assertEquals(3, tokens.size());
+  }
+
   /**
    * HDFS-3062: DistributedFileSystem.getCanonicalServiceName() throws an
    * exception if the URI is a logical URI. This bug fails the combination of