diff --git a/share/mk/src.opts.mk b/share/mk/src.opts.mk
--- a/share/mk/src.opts.mk
+++ b/share/mk/src.opts.mk
@@ -519,6 +519,14 @@
 .endif
 .endfor
 
+# MIT Kerberos requires GSSAPI and can't be built without it.  Once Heimdal is
+# removed, WITHOUT_GSSAPI will also be removed and GSSAPI will be controlled
+# by WITHOUT_KERBEROS.  In the mean time, raise an error in the MIT case when
+# trying to build Kerberos without GSSAPI.
+.if ${MK_MITKRB5} == "yes" && ${MK_KERBEROS} == "yes" && ${MK_GSSAPI} == "no"
+.error "MIT Kerberos cannot be built without GSSAPI"
+.endif
+
 #
 # Set defaults for the MK_*_SUPPORT variables.
 #
diff --git a/tools/build/options/WITHOUT_GSSAPI b/tools/build/options/WITHOUT_GSSAPI
--- a/tools/build/options/WITHOUT_GSSAPI
+++ b/tools/build/options/WITHOUT_GSSAPI
@@ -1 +1,4 @@
 Do not build libgssapi.
+.Pp
+This option is only meaningful if WITHOUT_MITKRB5 is enabled;
+MIT Kerberos always builds GSSAPI.