: Kerio uses an external database from Zvelo to categorize websites. The system uses key tokens that expire every 21 days. If Google Public DNS or restrictive ISP servers handle these specific requests, the validation sequence frequently fails.
Ensure outbound is completely unblocked on any upstream modem or carrier gateway, as Kerio needs this path to check license legitimacy.
: If you're unable to resolve the issue through self-troubleshooting, consider reaching out to GFI's technical support team for assistance.
If you recently renewed, click in the Configuration > Dashboard > License section to force the server to fetch the updated expiration date. 2. Check and Fix DNS Settings : Kerio uses an external database from Zvelo
Place this rule above any "Deny all" rules.
Once you complete these steps, verify that your protection features are fully functional:
Standard ISP DNS servers often fail or throttle the high volume of queries generated by Kerio Control. Moving your primary DNS forwarding to a reliable service like Cloudflare or OpenDNS often resolves this instantly. Log into the . Navigate to Configuration > DNS . Check the box to Enable custom DNS forwarding . Ensure outbound is completely unblocked on any upstream
Check the expiration date for the component specifically.
/opt/kerio/mailserver/kerio-control restart
When managing web traffic filtering in Kerio Control, you may encounter the following status indicators: Verifying the Fix If you want
If expired, renew your seat count with GFI Software to restore the categorization infrastructure. Verifying the Fix
If you want, I can produce a tailored checklist or step-by-step script for your specific Kerio Control version and environment—tell me the appliance OS/version, whether you use cloud categorization, and any recent changes.
: Users report that when the filter is "disabled," the entire security policy for web access may fail open or closed depending on configuration, leading to either security gaps or frustrated users unable to access legit sites.