If the license is valid and the internet is working, the service may be stuck.
Go back to your web admin panel. The firewall will automatically start downloading a clean, updated categorization database. 6. Update Kerio Control to the Latest Version
You can disable this "Reliability detection" via the GFI Support command-line fix to prevent automatic shutdowns during minor connectivity blips.
If your Kerio Control appliance cannot resolve external domain names, it cannot reach the activation servers.
Switch your custom DNS forwarding servers to Cloudflare ( 1.1.1.1 ) or OpenDNS ( 208.67.222.222 ). If the license is valid and the internet
/opt/kerio/mailserver/kerio-categorization status /opt/kerio/mailserver/kerio-categorization start
To avoid this error in the future:
Check the box for and click Edit (or Add ). Set the DNS name field to exactly *.zvelo.com .
One of the most common administrative headaches in Kerio Control environments is encountering a state where the Web Filter module reports that it is and "Categorization is Disabled." This state effectively renders Content-Aware Firewall policies useless, leaving the network vulnerable to malware, phishing, and productivity drains. This write-up explores the root causes of this issue and provides a step-by-step resolution guide. Switch your custom DNS forwarding servers to Cloudflare ( 1
Through years of troubleshooting Kerio installations, these five culprits account for 99% of these errors:
: Using certain DNS servers (like Google's) for all traffic can sometimes interfere with Zvelo's authorization tokens. in the admin interface. Custom DNS Forwarding *.zvelo.com Cloudflare (1.1.1.1) or (208.67.222.222). the Kerio Control appliance after making this change. Check Winroute Config : Ensure the DiaServerUrl is correctly set. /opt/kerio/winroute/winroute.cfg , verify that the value is v4.url.zvelo.com Activation Verification Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter is checked. Test a URL in the field to see if it provides a category. License Issues
This message indicates that Kerio Control's URL filtering engine—which categorizes websites (e.g., Social Media, Malware, Adult Content)—is either unlicensed, misconfigured, or experiencing a service interruption. When this happens, any firewall rule relying on will fail silently, potentially allowing blocked content or blocking allowed content depending on your rule logic.
A broken security handshake prevents the license module from activating the classification engine. Adult Content)—is either unlicensed
We recommend using reliable public resolvers like Google DNS ( 8.8.8.8 and 8.8.4.4 ) or Cloudflare ( 1.1.1.1 ).
This specific error in Kerio Control—where the web filter is shown as not activated and categorization is disabled— typically stems from connectivity or authorization issues with the third-party categorization service, . Common Causes
If the error persists despite a stable internet connection, Kerio Control's "Reliability Detection" may have permanently disabled the filter after 10 failed connection attempts support.keriocontrol.gfi.com . You can reset this via support.keriocontrol.gfi.com Log in to Kerio Control via SSH (e.g., using support.keriocontrol.gfi.com Navigate to the directory cd /opt/kerio/winroute Disable Reliability detection and reset the timers: ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the engine /etc/boxinit support.keriocontrol.gfi.com Configuration Check In the administration interface, go to Content Filter Applications and Web Categories support.keriocontrol.gfi.com Enable Kerio Control Web Filter is checked GFI Support If a specific site is still blocked erroneously, use the