Using a custom support address should not break allowlist/blocklist functionality

Many thanks CJ, Thanks for your time on this,

Perhaps I could fill out some more information this issue.  Since I was told that what we are seeing is considered "expected behavior"  I left detail out.  Maybe this detail does explain why it may be expected behavior.

At this time we are interested in having a small set of legitimate customer and organization domains listed in the allowlist, and a wildcard blocklist.

We also have a forwarder from our support email address to the one allocated by Zendesk.

The Zendesk customer support rep tells us that the allowlist/blocklist is always recognizing the forwarder email address as if it were the original recipient, and since our organization domain is specifically allowed, then everything is allowed.

This is the behavior we are seeing at this time.

All the best,

I'm thinking that what you were told wasn't quite right, because I do a ton of blocking and have a ton of emails set up for forwarding. If the email address that shows up as the requester email, is the one you want blocked, that should be doing the trick. However, I have run into some undocumented blocklist things that can thwart this, any chance these would explain what you're seeing? 

1. If the blocklist has a domain blocked, and a specific email from that domain set to rejected as well, the rejection rule must come before the block rule, or the rejected email address will still show up in suspended still. This is because as it soon as it hits a match for a rule on the blocklist, it uses that rule and stops looking further. What does this mean? Say you had these rules: 
` badbusiness.com reject:badactor1@badbusiness.com `

This is saying "send emails from the domain badbusiness.com to suspended, and reject entirely, don't show anywhere in my Zendesk, emails from badactor1@badbusiness.com." Except to make it work, you need the more specific rule first, otherwise it will match on "send badbusiness.com domain emails to suspended" and not apply the specific rejection rule, because it stopped looking once it matched on the first rule about the domain. You would want them in this order:
`reject:badactor1@badbusiness.com  badbusiness.com`

2. A rejected email address can still show up in your Zendesk if an agent forwards an email from that user to Zendesk. This is why I feel like what you were told isn't quite right. Even when forwarded by an agent, my Zendesk is seeing the domain badbusiness.com, and suspending those forwarded tickets. It does ignore the rejection rule though, and I think only gets caught in suspended due to my having the domain blocked there as well as rejecting some specific addresses. If you were using all rejection rules in your blocklist, that might end up dumping blocked address, but forwarded tickets into your real tickets.