Managing suspended tickets and spam

Managing suspended tickets and spam

Email sent to your Zendesk can be suspended or rejected. Suspended email is not necessarily spam. This article explains the other reasons tickets can be suspended and what to do about them.

Topics covered in this article:

What are suspended tickets?

When an end-user submits a support request by email, in most cases the email becomes a new ticket or adds a comment to an existing ticket. In certain cases though, the email is suspended. Suspending an email means putting it aside for further review. It's not necessarily spam. It's just not a ticket in your Zendesk yet. It remains in limbo until somebody reviews it and decides whether to accept or reject it. If nobody reviews it, the email is deleted after 14 days.

Suspended emails are displayed in a system-generated view. Click the Views () icon in the sidebar and then click the Suspended Tickets view. (In Zendesk Classic, the view won't be listed if you don't have any suspended tickets.)

An email can be suspended for several reasons, some for intentional policy reasons. A common reason is that the email is from an unregistered user when you require users to register. Example:

For more information, see What causes tickets to be suspended? below.

We recommend implementing a process for reviewing suspended emails. See Guidelines for reviewing suspended tickets below.

Instead of being suspended, an email can be rejected outright. A rejected email is not kept for further review and it can't be recovered. Email is rejected for the following two reasons:
  • The email is spam. If the email is rated as having a 99% or better chance of being spam, it's rejected. If the rating is less than a 99%, the email is suspended to give you a chance to confirm that it's really spam.
  • You blacklisted the email address or domain. See Using the whitelist and blacklist to control access to your Zendesk.

What causes emails to be suspended?

Emails are suspended for two basic reasons:

  • the sender is not allowed to create or update a ticket
  • the sender is not a person

The sender is not allowed to create or update tickets

An email can be suspended if you require users to register before submitting their first ticket, or if you have a closed or restricted Zendesk that limits who can submit tickets.

  • In an open Zendesk requiring users to register, anybody can submit tickets as long as they register first. After submitting a first ticket, the ticket is suspended and a welcome email is sent to the new user requiring them to register before the ticket can be submitted. After the user verifies their email address and creates a password, the ticket is unsuspended.
  • In a closed Zendesk, only designated users can create or update tickets. An administrator designates who can submit tickets. If an unknown person tries to submit a ticket, the email is suspended.
  • In a restricted Zendesk, only users with email addresses in certain domains can register and submit tickets. Emails in other domains are either suspended or completely rejected, depending on your setup.

A sender can also be prevented from updating a ticket if the email token identifying the ticket is stripped from the reply email. For more information, see Understanding the email token in the agent's guide.

The sender is not a person

Emails are suspended if your Zendesk detects they're not from real users. Examples:

  • suspected spam
  • automated response emails
  • emails from system users such as mail-daemon@ or postmaster@
  • emails with a 'no-reply' address

See Cause of suspension descriptions below for more information.

Guidelines for reviewing suspended tickets

Review your queue of suspended tickets on a regular basis. Follow review guidelines like the ones suggested below. The guidelines vary depending on how your Zendesk is set up.

You can review suspended emails one-by-one or in bulk. The choice depends on your policy and the volume of suspended emails to be recovered or deleted. When reviewing emails in bulk, recovering them creates a batch of tickets. When reviewing emails one by one, you have the option of recovering each email automatically or manually. The automatic recovery option creates the ticket immediately. The manual recovery option lets you edit the ticket properties before it's created. For step-by-step instructions, see Viewing, recovering, and deleting suspended tickets in the agent's guide.

Review guidelines for an open Zendesk

In your Zendesk, anybody can submit tickets. You may or may not require them to register first. If they have to register, the first ticket is suspended while a welcome email is sent to the new user requiring them to register before the ticket can be submitted.

Guidelines if you don't require users to register

  1. Recover emails that should be tickets. In particular, look for the following cases:
    • ticket notification replies with the email token stripped out (cause of suspension in the Suspended Tickets view: "Permission denied due to unauthenticated email update")
    • spam emails that aren't spam (cause of suspension: "Detected as spam")
  2. Bulk delete any remaining emails.

Guidelines if you require users to register

  1. Recover tickets from users who haven't registered yet. Recovering the ticket also registers the user. To identify the emails, look for the following cause of suspension in the Suspended Tickets view: "User must sign up to submit email, user notified." Note that the user's email remains unverified until the user responds to the welcome email sent to them.
  2. Recover other emails that should be tickets. In particular, look for the following cases:
    • tickets that registered users submitted through the web form while logged out (cause of suspension: "Submitted by registered user while logged out")
    • ticket notification replies by registered users from unverified addresses (cause of suspension: "Submitted by unverified user")
    • ticket notification replies by registered users with the email token stripped out (cause of suspension: "Permission denied due to unauthenticated email update")
    • spam emails that aren't spam (cause of suspension: "Detected as spam")
  3. Bulk delete any remaining emails.

Review guidelines for a closed or restricted Zendesk

In your Zendesk, only designated persons can submit tickets directly. You may have a suspended ticket workflow in place to let anonymous users submit tickets indirectly. When a support request from an anonymous user is received and suspended, an agent reviews the email and either recovers or deletes it.

Guidelines

  1. If you accept tickets from anonymous users, review and recover them one by one, either manually or automatically. To identify them, look for the following causes of suspension in the Suspended Tickets view: "Permission denied for unknown email submitter" for a closed Zendesk or "Sender domain not in the whitelist" for a restricted Zendesk.
  2. If you have a restricted Zendesk and require approved users to register, recover tickets from approved users who haven't registered yet. Recovering the ticket also registers the user. To identify the emails, look for the following cause of suspension: "User must sign up to submit email, user notified." Note that the user's email remains unverified until the user responds to the welcome email sent to them.
  3. Recover other emails that should be tickets. In particular, look for the following cases:
    • tickets that registered users submitted through the web form while logged out (cause of suspension: "Submitted by registered user while logged out")
    • ticket notification replies by registered users from unverified addresses (cause of suspension: "Submitted by unverified user")
    • ticket notification replies by registered users with the email token stripped out (cause of suspension: "Permission denied due to unauthenticated email update")
    • spam emails that aren't spam (cause of suspension: "Detected as spam")
  4. Bulk delete the remaining emails.

Reducing suspended spam

Zendesk uses spam detection software to rate incoming email. If the email is rated as having a 99% or greater chance of being spam, it's rejected and you never see it. If it's rated as having less than a 99% chance of being spam, the email is added to your suspended tickets to give you a chance to confirm that it's really spam.

If you find that you're receiving more spam emails than you'd like in your suspended tickets queue, you can use the blacklist to reject specific email addresses and domains. See Using the whitelist and blacklist to control access to your Zendesk.

Note: The option to blacklist email is not available in a closed Zendesk where administrators designate who can submit tickets.

Using the whitelist to prevent suspensions

Using the whitelist only prevents one cause of suspension ("Sender domain not on whitelist") but not the others. The whitelist is used in conjunction with the blacklist to restrict access to your Zendesk. Emails submitted by end-users on the blacklist are suspended or rejected. The whitelist specifies who is exempt from the blacklist rules, not from the email suspension rules.

For example, an email from a white-listed user can still be suspended because the user hasn't registered yet (cause of suspension: "User must sign up to submit email, user notified").

For more information, see Using the whitelist and blacklist to control access to your Zendesk.

Setting up suspended ticket notifications

In addition to the Suspended Tickets view, you can set up a suspended tickets notification email that is sent to specific email addresses.

In the Suspended Ticket Notifications section of the Tickets settings page, you can select the frequency and enter the email addresses that you want the notifications to be sent to.

To set up suspended ticket notifications

  1. Click the Admin icon () in the sidebar, then select Tickets.
    Zendesk Classic: Select the Setting menu, then select Tickets.
  2. In the Suspended Ticket Notifications section you can select the frequency and enter the email addresses that you want the notifications to be sent to.
  3. Enter the email addresses you want the notifications sent to.
  4. Click Save tab.

If you later want to cancel these notifications, select Never.

You'll only receive the notification email if there are tickets in the suspended tickets queue.

Cause of suspension descriptions

The Suspended Tickets view displays messages describing the cause of suspension for each suspended email. Example:

The following table lists the possible descriptions in the view and what each one means.

Cause of suspension Description
Automatic email processing failed Although rare, you might see this if a system-wide email processing error occurred.
Automated response mail This is used when the email header indicates that the message is an auto-generated email response.
Automated response mail, delivery failed This indicates that an outgoing email notification was not delivered to its recipient. The delivery failure email response is suspended so that a ticket is not created.
Automated response mail, out of office Out of office and vacation auto-generated response emails are suspended.
Detected as mail loop If you receive a large number of emails from a single sender in a short period of time, those emails are suspended and the sender's address is blacklisted for one hour. This also happens to tickets that are sent from an address equal to your default Reply To address.
Detected as spam The email has been flagged as spam with a probability lower than 99%. If the probability is 99%, the email is rejected. The email might also have been flagged as spam because it is from a suspended user.
Detected email as being from a system user Email generated by a mail server (for example, messages sent from addresses beginning with mail-daemon@ and postmaster@) are suspended because it is assumed that they are not intended to be support requests.
Email for 'noreply" address The email address is a "no reply" email address, meaning that it is not intended to receive email.
Email is from a blacklisted sender or domain The email came from an address or domain that you've blacklisted. See Using the whitelist and blacklist to control access to your Zendesk.
End user only allowed to update their own tickets This indicates that an email response (ticket update) was received from a user (email address) that is different from the original submitter's email address. This might happen if the submitter forwarded the email to a different email account and then attempted to reply back to your Zendesk. Multiple email addresses per user are supported but they must be added to the user's profile.
Permission denied due to unauthenticated email update This indicates that the email header doesn't contain the email token identifying the ticket. This can happen if an email client strips out email header information. See Understanding the email token.
Permission denied for unknown email submitter When you require your users to register and create an account, email received from unregistered (unknown) users is suspended.
Received from support address The email was sent by (not forwarded from) one of your support addresses. For information about support addresses, see Adding support addresses for users to submit support requests.
Sender domain not on whitelist When your account is configured to only allow emails from a given set of domains (using the whitelist), this indicates that the sender's email address or domain is not within that set.
Submitted by unverified user This indicates that the user is known in your Zendesk but has not yet verified their email address.
User must sign up to submit email, user notified This is used when an account requires end-users to register and therefore verify their email address before submitting tickets. Once their email address/user account is verified, they can submit tickets.
Have more questions? Submit a request

Comments

  • Avatar
    Ralf Wittgen

    You write for mail loop email "If you receive a large number of emails from a single sender in a short period of time, those emails are suspended and the sender's address is blacklisted for one hour. This also happens to tickets that are sent from an address equal to your default Reply To address."

    a. What is a large number of emails? 10 emails, 5 emails?

    b. What is a short period of time? 30 minutes?

    c. How can I view in zendesk that an address is blacklisted for one hour?

    Thanks :)

  • Avatar
    Johannes Schunter

    We are set up to receiving about 200 per user requests per day through a web site form, so the sender address is always the same and the ticket ends up in the suspended list because of the "email loop" criteria. Can I white list certain email addresses so the email loop criteria is not applied?

  • Avatar
    Kathleen - ProjectManager.com

    We are set up to receive daily system generated emails with details of errors from our product.  These are sent from the same email as our zendesk replyto address.  We have tried whitelisting this address to prevent emails from being marked suspended and had no success.  We have also tried configuring triggers to prevent these messages from being marked suspended with no success.  How can we handle these emails?

    Thanks

  • Avatar
    Donnie Byrd

    Is there a way to disable this one from happening: Submitted by registered user while logged out

    This happens to me a lot, and my users say they have never received such a verification email. 

  • Avatar
    Ben

    Suspended tickets labeled "Submitted by registered user while logged out" and "End user only allowed to update their own tickets" are, 100% of the time, false-positives for us. We have to go through daily and fish them out of the pit.

    I've asked about enabling some control over which suspension reasons are in use or how they're applied in other forums but no firm word as yet...

  • Avatar
    Michael Wilson

    I have a monitoring service configured to automatically submit a support ticket if certain criteria are met.  Its support tickets are suspended because of its email address (no-reply@).  Is there a way to turn this off, or will I need to set up a forwarder?

  • Avatar
    Justin

    Hey Michael: 

    I'd recommend setting up a forwarding address, however, you can whitelist an email address in Settings > End-users

  • Avatar
    Royewole

    Hey Justin, having some trouble figuring out how to whitelist email addresses. 

    I've navigated to Setting --> People but I only see the option to browse end-users. The no-reply emails I'd like to make tickets from are listed as unverified, but since they're no-reply (and no inbox to receive a verification email) I'm not sure how to go about verifying them. 

    Any assistance would be awesome. Thanks

  • Avatar
    Justin

    Hey Rotimi: 

    If you're using the new Zendesk interface, click on the cog, and head to Settings > Customers. You'll see the whitelist option there. To verify those accounts, just click on name from Manage > People and then click on their primary email address; you'll notice an option to Verify now. 

  • Avatar
    Discoverstuff

    Justin, is there a way to add the subject of an e-mail to a whitelist?  I have quite a few coming in from an e-mail reply that have the same subject but they are from new users each time.

  • Avatar
    Ben

    Let me second this idea as a feature request - aside from 100% of our "End user only allowed to update own tickets" and "Submitted by user while logged out" Suspensions being false positives, for some reason one of the Emails in our standard sequence sent out to new users gets Suspended very frequently. 

    If we could white-list that subject and turn off the other two suspension causes, the proportion of tickets in the Suspended queue which we actually don't want would jump dramatically!  (for example, LinkedIn invites...)

  • Avatar
    Justin

    It's currently not possible to whitelist the email subject. I can see how this would be beneficial, though. Thanks for your feedback! 

  • Avatar
    sandy F

    I am using WuFoo form builder and my emails have the reply to address set as a customer email, but they come FROM a system account email so they are getting suspended. What can I do to fix this? This will be a big factor if we can't use this, we tried it with 1 form that we are using an automation with and we can't use the automation if it is suspended. 

     

    Is there a way to automate emails sent to a specific email out of suspension?

  • Avatar
    Justin

    Hi Sandy: 

    Try adding the address to your whitelist, located in Settings > Customers

  • Avatar
    sandy F

    Thanks Justin, that seems to have worked. 

  • Avatar
    UNSW

    +1 for us being allowed to modify the rules around Suspended Tickets "Submitted by registered user while logged out" .

    As Ben says, above - "enabling some control over which suspension reasons are in use"  would be helpful.

    Has anyone had any response from Zendesk about this?

    Cheers, Crispin 

  • Avatar
    Justin

    The mail filter acts in the same way for all accounts globally. We have no plans to allow specific rule modification. However, the more feedback the better. As of right now, we won't be exploring this in the immediate future. 

  • Avatar
    Kaylee

    We have an Enterprise account with 4 branded accounts set up for email forwarding. Anytime an employee sends an email to the everyone distro list it creates a ticket for each of those branded accounts. We have checked that those email accounts are not included on the everyone distro list. Any ideas on how we can block emails sent TO (not FROM) a certain email address? Or how to stop creating 4 tickets anytime someone in my company sends an email to everyone@mycompany.com?

     

    Thanks!

  • Avatar
    Justin

    Hi Kaylee: 

    It sounds like your everyone address is configured to forward incoming messages to your Zendesk accounts. I'd double check the mail forwarding rules for that specific address first! 

  • Avatar
    Henrik Zillmer

    Hi Justin

    I keep getting the "Detected as mail loop" message and emails ending in suspended tickets. Here is the setup:

    Customers send first email to plans@airhelp.org, which then creates a ticket. Our support answers from support@airhelp.org (default reply-to email address). Customers reply to support@airhelp.org, which then ends in suspended ticket!!!

    We have whitelisted support@airhelp.org and setup forwarding of all mail sent to support@airhelp.org to plans@airhelp.zendesk.com.

    Help pls.

  • Avatar
    Justin

    Hey Henrik: 

    Give this article a read: https://support.zendesk.com/entries/20519926-getting-started-with-email-in-zendesk

    Your mail forwarding setup is a little off! Because support is forwarding to_ plans,_ and_ plans_ forwards to your Zendesk account, it creates that loop. If support@mydomain.com is forwarding mail, it needs to send it to support@mydomain.zendesk.com -- if plans@mydomain.com is forwarding mail, it needs to send it to plans@mydomain.zendesk.com

  • Avatar
    Brian

    if you whiteliste No-reply@___ will it override the automatic blocking mechanism ?  

  • Avatar
    Justin

    I don't think so, Brian. I'm not 100% sure, so give it a try. The incoming message filters are fairly strict, and it looks to separate those noreply addresses. 

  • Avatar
    Erik Aronesty

    For our  company, when an unauthorized user posts to an existing ticket, it would be MUCH better to show the email on the ticket... than to put it in suspended.   All the other suspension rules are fine for us.   But this rule is really hurting customer relationships.  I would really like to turn off this rule, or be able to get an email every time it's triggered.

  • Avatar
    Justin

    Makes sense, Erik. Unfortunately, there's no way to change how message filter processes those responses. Those types of comments will always end up in the suspended queue for now. I wish we had some more flexibility here! 

  • Avatar
    mmaher

    We are having a problem whenever someone within the company is CC'd on a ticket. Every single ticket becomes suspended with the "Mail Delivery Failed: Returning Message to Sender" error. Looking within the error, it says that the email address of the person who was CC'd had failed, and that there is an invalid header in the message. Is this something that anyone has run into before?

  • Avatar
    Justin

    We'd need to take a look at the original email. Send a ticket to support@zendesk.com with the appropriate attachments and we'll get it figured out. 

  • Avatar
    Sean Harrington

    Is there a way to turn this function off completely?

  • Avatar
    Erik Aronesty

    Justin: "there's no way to change how message filter processes those responses"   ... there's also no technical reason why this is the case... unless you lost some of your core developers. It's just too easy to throw an "if rule looks like X and user checked Y then do Z" logic in a piece of code.

  • Avatar
    Brandon K.

    @Sean: Unfortunately not, the suspended tickets queue is not one of our most flexible features and there is no way to completely disable it at this time.

    @Erik: Justin wasn't implying that it isn't programmatically possible, but that we do not allow you to. I've forwarded your feedback though, hopefully we can use your tip to fix this with our developers.

Please sign in to leave a comment.