Kerio Control Web Filter Is Not Activated Categorization Is Disabled Work ~upd~ Jun 2026

. This triggers a "not reliable" status, causing the web filter to disable itself to prevent blocking legitimate traffic due to a lack of data. support.keriocontrol.gfi.com Direct Solutions Wait for Automatic Reversion

: DNS modifications require a reboot to take full effect.

This article provides a comprehensive guide to understanding this issue, diagnosing the root cause, and implementing the necessary workarounds to restore web filtering functionality. What Does "Web Filter Categorization is Disabled" Mean?

: Kerio Control sends automatic DNS check queries to its update servers. If these fail 10 times in a row within one minute, the system deems the filter unreliable and disables categorization.

If you recently renewed it, click or re-register your license key to sync it with the GFI Software Registration Servers . 2. Confirm Appliance Internet Access and DNS Resolution This article provides a comprehensive guide to understanding

Once your Web Filter is operational, implement these preventive measures to avoid recurrence:

: Update these settings in Configuration > DNS , then reboot the appliance. 3. Verify License & Activation Status

What your firewall is currently using.

Restart the service using: /etc/boxinit.d/60winroute restart . 4. Check for Proxy Conflicts If these fail 10 times in a row

Change your to reliable providers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) instead of Google's DNS.

| Preventive Measure | Why | |--------------------|-----| | Set up monitoring alerts | Receive email notification if categorization stops. | | Regularly check license expiry | Add a calendar reminder 30 days before renewal. | | Use redundant DNS servers | Prevents single-point-of-failure resolution issues. | | Document upstream proxy changes | Any proxy change requires updating Kerio. | | Test after updates | Category servers change IPs; test every quarter. |

The following endpoints are used (depending on version). Ensure they are reachable on TCP 443:

Logs report Unable to categorize 'example.com' by Kerio Web Filter . 92 for “Gambling”).

SSL/TLS certificates secure the categorization API. If the firewall’s system time is off by more than a few minutes, certificate validation fails, and categorization is automatically disabled.

Subscription renewal is necessary for Web Filter to function. Corrupted/Invalid Authorization: Expired Zvelo token (expires every 21 days) or corrupted winroute.cfg support.keriocontrol.gfi.com 2. Immediate Workarounds & Fixes A. Fix DNS and Connectivity Change DNS Servers: Ensure your DNS servers are robust. Cloudflare ( ) or OpenDNS ( 208.67.222.222 ) are recommended for better *.zvelo.com resolution. Restart Kerio Control: A simple reboot often restores functionality. support.keriocontrol.gfi.com B. Fix "Categorization is Disabled" via SSH

If you are encountering the error your firewall has likely triggered a safety mechanism that pauses web filtering when it cannot reliably reach the categorization servers.

Kerio Control does not rely solely on static blocklists. Instead, it uses . When a user requests a website, the Kerio appliance queries a remote categorization server (provided by Kerio’s parent company, GFI Software, or a third-party partner like McAfee). The server returns a category ID (e.g., 92 for “Gambling”). The appliance then applies your content rules.

Resolving this issue requires checking your . 🛠️ Step-by-Step Troubleshooting Guide