Overview

While reviewing Warning logs, the following Web Filter entries are shown.

  Unable to categorize 'website.com/' by Kerio Control Web Filter. DNS response 'FAILURE: Invalid authorization'
  to query '0.website.com.5a02.ko-326122.v3.url.zvelo.com' is invalid.

Kerio Control Web Filter is reported to be not activated, and categorization is disabled.

This article provides details on how to resolve such Web Filter categorization issues.

Solution

Kerio Control Web Filter is using 3rd-party categorization tools from Zvelo.

"Invalid Authorization" error typically means that an expired Zvelo key token was used. They expire after 21 days. The token is being transferred from Kerio internal servers if the correct DiaServerUrl value (v3.url.zvelo.com) is specified in /opt/kerio/winroute/winroute.cfg file accessible through the SSH console.

This can happen when setting Google's IP addresses as custom DNS forwarding servers.

It's recommended to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222, 208.67.220.220) servers as Custom DNS servers for *.zvelo.com URLs.

Note: as the issue may occur sporadically, it's recommended to reboot your Kerio Control after custom DNS forwarding is modified.