Using the allowlist and blocklist to control access to Zendesk Support

Fastpath: Admin Center > People > Configuration > End users

You can control access to your Zendesk by adding end users' email addresses and domains to your blocklist and allowlist. Using the blocklist, you can prevent specific users, or sets of users, from registering and submitting support requests. Using the allowlist, you can allow specific users, or sets of users, to access your Zendesk and submit support requests.

This article contains the following sections:

• About the blocklist and allowlist
• Setting up your blocklist and allowlist
• allowlist and blocklist usage examples

About the blocklist and allowlist

The blocklist and allowlist can help you create rules for accepting, suspending, and rejecting users' emails. Any email that is suspended because of the blocklist will be added to the suspended queue and flagged. If you have set up user mapping, any email domains you add to the allowlist will automatically be included (see Automatically adding users to organizations based on their email domains).

Your allowlist will automatically override your blocklist. For example, if you blocked a specific domain, but allowed a user with that email domain, they will be given access.

Note: If you blocklist a user that is CC'd on a ticket, they will not be removed from existing tickets. If an email address is blocked, an agent can still add the user as a CC, and they will still receive CC email notifications. To prevent CC notifications, you will need to suspend the user. The email address will still be visible, but agents cannot add the user to the ticket.

Depending on how your Zendesk is set up, you can use the blocklist and allowlist to apply additional settings to control who can access your Zendesk. If your Zendesk permits anyone to submit tickets, such as in open support type, you can use the blocklist to filter out spam email addresses and domains (see Suspending a user in the Zendesk Agent Guide). Any ticket from a user or domain on the blocklist is automatically sent to the suspended tickets queue. If you require users to register, you can use the blocklist, so only approved email address and domains can submit support requests and authenticate accounts.

The blocklist and allowlist feature contains rules you can combine to easily restrict access. See the section below for a list of the available blocklist and allowlist rules.

Setting your blocklist and allowlist

Before setting up your blocklist and allowlist, you should consider the following rules:

• You can enter up to 10,000 characters in each of the allowlist and blocklist fields.
• To allow all users to submit tickets to your Zendesk, except those added to the blocklist, leave the allowlist blank.
• To suspend ticket submissions from all users, except for those added to the allowlist, add a wildcard(*) in your blocklist.
  Important: The wildcard will send tickets from every user not added to the allowlist into the suspended tickets queue, and prevents new users from creating accounts.
• Use keywords or symbols with a blocklist or allowlist entry to make the restrictions broader, or more specific:
  • To block or allow an entire email domain, do not include the "@" symbol. An email domain will not be successfully added to the allowlist or blocklist with "@".
  • To completely block support requests from specific users, enter the keyword reject: in front of an email address or domain list in the blocklist. Tickets will not be added to the suspended tickets queue and there will be no record of the ticket in your Zendesk.
• To block or allow an entire email domain, do not include the "@" symbol. An email domain will not be successfully added to the allowlist or blocklist with "@".
• Being placed on the allowlist does not allow users to override their tickets from being suspended if the subject contains the text "Out of Office" or if the ticket comes from an email flagged as a "do not reply" address.
• To completely block support requests from specific users, enter the keyword reject: in front of an email address or domain list in the blocklist. Tickets will not be added to the suspended tickets queue and there will be no record of the ticket in your Zendesk.

Note: reject: only applies to support requests and doesn't prevent users from creating an account in your Zendesk.

To edit your blocklist and allowlist

1. In Admin Center, click the People icon () in the sidebar, then select Configuration > End users.
2. In the Anybody can submit tickets section, select Enabled. This setting is required to use your blocklist or allowlist.
3. Enter your allowlist and blocklist settings. You can view some of the common blocklist and allowlist examples in the section below. If you are adding multiple email addresses or domains, separate with a space.

   

4. Click Save tab.

Allowlist and blocklist usage examples

You can use a combinations of the blocklist and allowlist rules to ensure you are permitting access or blocking the correct users. This section contains some usage examples you can replicate for your own Zendesk.

Approve a domain, suspend all other users

You can allow specific domains access to your Zendesk by adding the domain in the allowlist and suspend all users with a different email domain by adding a wildcard (*) in the blocklist. In the example below, only email from the domain mondocampcorp.com will be permitted access.

allowlist: mondocamcorp.com
blocklist: *

If you want to allow more than one domain access, you can enter multiple domains separated by a space. In the example below email from the domains mondocamcorp, comdocam, and mondostore are permitted and all other users will be suspended.

allowlist: mondocamcorp.com mondocam.com mondostore.com
blocklist: *

Approve a domain, but suspend specific email addresses with the domain

You can prevent a specific email address with an allowed domain from accessing your Zendesk by using the suspend keyword.

In the example below, only email from gmail.com is given access, except for the email address [e-mail].

allowlist: gmail.com
blocklist: * suspend:[e-mail]

Approve a domain, but reject specific email addresses and domains within it

Similar to the previous example, you can block specific email addresses from using an allowed domain by entering their email address in the blocklist. You can use the reject keyword to prevent a user's tickets from being adding to your Zendesk at all.

In the example below, only email from gmail.com is accepted. All tickets from other email domains are sent to the suspended tickets cue, except for the email address [e-mail]. Email from [e-mail] will be rejected completely, and the ticket will not be recorded in your Zendesk.

allowlist: gmail.com
blocklist: * reject:[e-mail]

Note: If you are still getting requests from blocked domains or email addresses, we recommend that you contact Zendesk Customer Support, so we can help you diagnose the problem. This can be the result of email spoofing.

Approve all, but reject specific email addresses and domains

Unlike the examples above, you also have the option of allowing all users to register, except for specific email address and domains. To allow all users to register, you can leave the allowlist blank, then enter any blocked users.

In the example below, everyone can access your Zendesk, except for [e-mail] and megaspam.com. Since the reject: keyword is used, all email from those accounts will be blocked completely and the ticket will not be recorded in your Zendesk.

allowlist: 
blocklist: reject:[e-mail] reject:megaspam.com

Suspend support request tickets from specific email addresses or domains

Simply adding an email address or domain to your blocklist suspends tickets from those users, but only if those tickets are submitted through the email channel.

allowlist: 
blocklist: suspend:[e-mail] suspend:megaspam.com