Email sent to Zendesk Support can be suspended or rejected. Suspended emails are often, but not always, spam. This article explains what suspended tickets are and your options for managing them.
For information, see the support tip What does "Detected as spam" mean?
This article discusses the following topics:
What are suspended tickets?
In most cases, when an end user submits a support request by email, the email becomes a new ticket or adds a comment to an existing ticket. However, in certain cases, the email may be suspended. Suspending an email means putting it aside for further review. It's not necessarily spam. It's just not a ticket in Zendesk Support yet. It remains in limbo until somebody reviews it and decides whether to accept or reject it.
Suspended emails are collected in a system-generated view. The suspended tickets view is visible to any agent with access to all tickets. We recommend that you review the suspended tickets frequently. If nobody reviews a suspended email, it is automatically deleted after 14 days.
Sometimes, rather than being suspended, an email is rejected outright. A rejected email is not kept for further review and it can't be recovered.
- If the email is rated as having a 99% or better chance of being spam, it's rejected. If the rating is less than 99%, the email is suspended to give you a chance to confirm that it's really spam.
- You blocked the email address or domain. See Using the allowlist and blocklist to control access to Zendesk Support.
- The email was sent by an automated system (for example, a non-delivery notification email).
What causes emails to be suspended?
- The email is rated as spam. Spam is the most common cause for suspension.
- The sender is not allowed to create or update a ticket. For example, the email is from an unregistered user when you require users to register.
- The sender is not a person.
- The email failed DMARC authentication, which Zendesk uses to authenticate agent users.
Managing suspended tickets
For security purposes, Zendesk automatically performs some scanning of tickets to identify malicious content. However, the way you configure your account also influences how many emails are suspended.
- First, who do you allow to
If you have restricted ticket submission to only users with approved email addresses or closed ticket submission to everyone except the users you've added, you'll see more suspended tickets than you would if you allowed anyone to submit tickets.
- Have you enabled DMARC, SPF, or DKIM
authentication for incoming emails?
Each of these methods works differently to detect spam and spoofed emails, so they do result in more suspended tickets, but they also add a layer of security to the inbound emails that generate tickets.
- Are you using the allowlist and
Emails submitted by end users on the blocklist are suspended by default, but you can configure it so that they are rejected. The allowlist specifies who is exempt from the blocklist rules as well as bypassing some other standard causes for email suspension.
If you find that some of your security settings are resulting in too many suspended tickets, look for patterns of similarity to the valid tickets that are being suspended. Then use the allowlist and blocklist to permit emails that match that pattern.
We recommend implementing a process for reviewing suspended emails frequently. Any emails that remain in the suspended tickets queue for 14 days without review are automatically deleted.
I have a quick question, does the Events view show that a ticket was originally suspended? Does it show the date it was recovered and who the name of the agent that recovered it?
If not, these would be excellent features to add. Thank you!
Hope you're doing well!
I actually tried to recover a suspended ticket on my account, to see if it will show under ticket events. Sadly, it didn't show any sign that it was recovered either manually or automatically. This could be a cool feature to add in the future, though. For now, I understand this is not the answer you were hoping for, but you can up-vote this post and add your detailed use-case to the conversation. Threads with a high level of engagement ultimately get flagged for product managers to review when they go through roadmap planning.
Ahn L. | Customer Support Advocate
Thank you for all of your questions on this post. We love your feedback. If you have more product feedback on this topic, we'd like to hear from you!
Please find some time to talk to our product directly at https://calendly.com/pooja-palan/30min?back=1&month=2021-08
Our dev team sends us notifications that we use for taking action but they also send us testing emails that we do not want in our general ticket que and are identified by the title in the subject line. I would like those emails to go to the Suspended folder. Is there a way to filter or reroute certain tickets by subject instead of by the user email address?
Thanks for the help!
While it isn't possible to suspend based on ticket subject, you could create a trigger to automatically close such requests. You can test for specific subject/body text in triggers using the "Ticket: Subject text" and/or "Ticket: Comment text" conditions, based on where your targeted keywords most commonly appear. You could create a trigger that detects the spam messages based on the strings you've identified and instantly close such tickets.
Our article on trigger conditions and actions describes the "Ticket: Comment text" condition here: https://support.zendesk.com/hc/en-us/articles/115015611647-Trigger-conditions-and-actions-reference
Beau | Customer Advocate
Ask our Zendesk Community
Thanks for getting back to me so quickly. I already have triggers setup to close those tickets out but thank you for the suggestion. I was hoping there might be a way to have those specific tickets not even appear in my All Tickets view or blocked somehow from being accepted. Any ideas?
Thanks again for the help!
Blocking outright via the email address or domain is the only other option, so if you intend to allow messages from a user and only want to route certain ones, the trigger workflow is the only other option. It isn't possible to outright reject messages from a permitted user based on subject or comment text, only identify that content and automatically close tickets via the trigger workflow described.
Beau | Customer Advocate
Ask our Zendesk Community
Hello - We have a large volume of suspended tickets that are recovered by our Tier 1 team. Unfortunately there is no way to identify those tickets that have been recovered or report on them. It would be helpful to have a tag or event or some sort of identifier that would allow our managers to report on this volume and assist in resource planning (assign a certain number of agents to monitor the suspended queue).
Hello, is it possible to hide the suspended and deleted tickets from the views? Thanks!
Unfortunately, there isn't a specific indicator for recovered suspended tickets, we understand your need for this functionality, so I have marked this ticket as product feedback. Further, I am also encouraging you to create a new post on the General Product Feedback topic in our community to engage with other users who have similar needs and discuss possible workarounds. Conversations with a high level of engagement ultimately get flagged for product managers to review when they go through roadmap planning.
Specific examples, details about impact, and how you currently handle things are helpful for our product teams to understand the full scope of the need when working on solutions. You may also want to review the Product feedback guidelines and how to write an effective feedback post [https://support.zendesk.com/hc/en-us/community/posts/360004391547-Product-feedback-guidelines-how-to-write-a-good-feedback-post].
We truly value customer feedback and your voice and votes in the forums help influence future Zendesk functionality.
The Deleted Tickets View can be hidden from users via either specific role permissions on Enterprise plans, or a global permission setting on other plan types. Information on how to do so can be found here: Enabling agents to delete tickets
Unfortunately, Suspended Tickets View is a default view and no option to hide it is available as of the moment
We had an end user who added our support alias to a zoom meeting invite and their following tickets were marked as spam and suspended. Is this intentional?
How can I disable the Suspended ticket folder altogether? I find it populated with voice messages that appear to have been dialed from VoIP or a computer.
Hi Zendesk Product Team - We want to be able to make changes to the views of Suspended ticket to add additional columns/info =( , its not practical as we have multiple support addresses looked after by different groups, its too hard for them to identify tickets relating to them and have to look through each ticket one by one
I have to say, articles like this are pathetic. If the article was just a link to to where you adjust the blocklist it would have been a far superior article. In stead you get a bunch of words that tell you nothing / stuff you already know without letting you know where to fix the problem. Could care less about how. If I can't find the feature - how can I use them!!!
The how is almost the same across all software, the where unique is unique to almost all software. The where is always known to support staff. The where is never known to clients. It is the MOST IMPORTANT INFORMATION TO INCLUDE.
Here it is for you.
Hi Zendesk team,
I have a question related to suspended tickets and hope you could help me.
Currently we are receiving all tickets 'coming from a support address' as suspended tickets but also duplicated as a regular ticket. I saw in your article it was because it's causing an email loop?
However, our different department are creating tickets with the support address in Zendesk for a couple of months already and all went okay (no suspended tickets) until two weeks ago. The support addresses are all added on the white list in Zendesk.
Could you tell us what is the exact cause and how to fix this?
Thank you in advance.
Based on the information you have provided, it is working as expected. You are not allowed to send ticket using your own support address. If it has been working before, it only means that there is an issue that has already been corrected. If you check Causes for ticket suspension you can only avoid this from happening if your employees change the from and reply-to address.
Myron and King Leong,
Suspended tickets view is a system view that cannot be modified or disabled.
I'd recommend creating a Community post separately for that with your use case to help get more visibility and votes on the idea. Then, others can share their use cases to further drive demand for that feature.
We appreciate your feedback regarding the structure of our articles. However, we also promote self service and the hows are integral part of knowing the process of our Product. In addition, the information you are looking for can be found in Setup Blocklist and Allowlist.
Typo, check the capitalized word below
Email sent to Zendesk Support can be suspended or rejected. Suspended emails are OTEN, but not always, spam. This article explains what suspended tickets are and your options for managing them.
I'll share this with our documentation team so they can get this article updated.
If nobody reviews a suspended email, it is automatically deleted after 14 days.
What is the design logic to delete such suspended emails from Zendesk?
How can we trace back to see what emails have been deleted by Zendesk?
BTW: Why use API to recover one by one, the ticket is created with my name? What is the logic to design such function?
Suspended tickets will pile up and use the allocated storages for accounts. To make sure that this will not happen, it will be purged within 14 days. Unfortunately, suspended tickets are not part of our native reporting.
If you feel this isn’t sufficient feel free to provide feedback in the Community page.
This is to engage with other users who have similar needs and discuss possible workarounds. Conversations with a high level of engagement ultimately get flagged for product managers to review when they go through roadmap planning.
We suddenly have a slew of tickets that are ending up in the Suspended folder that should not be. The communications that are going out are invitation emails that are automatically generated when our customers add users to our platform. How can I fix this?
We have found that the filter "learns" as long as we ongoingly have someone review the suspended tickets queue. So a couple weeks of un-suspending tickets that should not have been suspended trains the filter over time, and false-positives drop.
In our experience, you have to continue to review the queue over time. You cannot simply get it to "good enough" and then stop reviewing. The filter will lose training and at the same time, spammers tactics change.
Quick question, hoping somebody might know more. We are currently receiving a number of malicious links by means of a HTM or HTML filetype attachments. Is it possible to instruct Zendesk to automatically mark such tickets as suspended? By and large, our customers have no reason to attach such a filetype for legitimate reasons, and we review suspended tickets closely in either case.
I haven't seen a setting that can help with this, nor a trigger or automation, so if this is feedback I will log it there (from a quick search within the community I didn't see a similar request).
It's not possible to automatically mark such tickets as spam. However, our system can be trained so that it can identify such tickets as spam in the future. What your agents can do is to continue to manually mark such tickets as spam. This will help improve our spam filters for such tickets.
Please sign in to leave a comment.