Steps to reproduce:

1. Configure a Zabbix Proxy (active mode, MySQL backend, official Docker image) and assign it to a Proxy Group.
2. Confirm the proxy shows as Online and version "Current" in Administration → Proxies.
3. In the frontend, create a new host: Monitored by = Proxy group, template "Linux by Zabbix agent active", PSK encryption configured, Enabled.
4. Trigger Refresh configuration for the proxy (or wait for the ProxyConfigFrequency interval).
5. Start the Zabbix agent on the monitored host with a matching Hostname.

Result:

The proxy rejects the agent's active checks request:
 
{{cannot send list of active checks to "192.168.1.29": host [windowsad.mutualentreasoc.com.ar] not found
autoregistration from "192.168.1.29" denied (host:"windowsad.mutualentreasoc.com.ar" ip:"192.168.1.29" port:10050): connection type "TLS with PSK" is not allowed for autoregistration}}
The host is present in the proxy database with correct hostname and status:
 
{{hostid | host | name | status
10697 | windowsad.mutualentreasoc.com.ar | mea-windowsad | 0}}
However, the host is missing from the in-memory configuration cache. With debug logging enabled on the configuration syncer, DCdump_host_proxy_index() lists only 4 of the 5 monitored hosts — the newly added host is absent:
 
{{In DCdump_host_proxy_index()
host:ns1.mutualentreasoc.com.ar proxyid:1
host:windowsfs.mutualentreasoc.com.ar proxyid:1
host:docker01.mutualentreasoc.com.ar proxyid:1
host:datagw01.mutualentreasoc.com.ar proxyid:1
End of DCdump_host_proxy_index()}}
The same debug run shows an empty incremental sync:
 
configuration syncer [synced config 95 bytes in 0.220696 sec, idle 10 sec]
Restarting the proxy container resolves the issue immediately — the host appears in the index and the agent registers within seconds. This has been reproduced with two different hosts.

TLS is not the cause: the PSK handshake completes successfully (the proxy reads the hostname from the request before failing the lookup). The autoregistration message is a side effect of the failed host lookup, not the root cause.

Expected:

After a successful configuration sync, a host assigned to the proxy group should be added to the proxy's in-memory host_proxy_index and the agent's active checks request should succeed, without requiring a proxy restart.

Additional information:

• Proxy mode: active, MySQL backend
• Proxy assigned to a Proxy Group (Minimum number of proxies = 1)
• Proxy → Server encryption: certificate. Agent → Proxy encryption: PSK
• Server reports the proxy as Online, version Current, last seen 0
• Attached: proxy configuration file (passwords redacted), full configuration syncer debug log