Plan requirement
| Subscription | Any plan |
| Access | Admin |
Attachments are on by default. What you can control is the size, whether they are private, and what happens to risky files.
Where the settings are
- Open Admin Center, then Objects and rules > Tickets > Settings.
- Expand Downloads and attachments. Everything below lives there.
Six settings, and they do genuinely different things:
- Allow agents to attach files in emails and Allow end users to attach files. Whether each side can attach at all.
- Private end-user attachments. Files sent by customers require a sign-in to open.
- Allow secure downloads. The same requirement for every attachment, agents' included. Turn this on and the previous setting disappears, because it is already covered.
- Attachment expiration. How long an agent's public attachment stays open as a link. Twenty-four hours by default.
- Allowed file types. An allowlist, covered below.
The size limit is not a setting
There is nothing here to raise. A file arriving by email or web form can be 50 MB. An outgoing email is stricter: 7 MB for one file and 10 MB for everything on the message together, which is the limit teams hit, because it applies to the reply your agent is sending rather than to what the customer sent.
Where large files are a normal part of your work, a link to a file sharing service is more reliable than pushing against two sets of limits.
Private attachments
By default a customer's attachment can be opened by anyone with the link, without signing in. That is convenient and it means a forwarded link reaches whoever it is forwarded to. Private end-user attachments closes that; Allow secure downloads closes it for agents' files as well. For anything carrying personal data, one of the two is the setting you want, and it is worth checking rather than assuming.
Which file types get through
This is a list you maintain, not something Zendesk decides for you. Allowed file types offers all file types, a recommended list of roughly sixty extensions, or your own. Accounts created after 13 August 2025 start on the recommended list; older accounts start on all types, which is worth checking if nobody has looked since.
Scanning happens on top of whichever you choose: every attachment is scanned and anything flagged as malicious is blocked rather than delivered.
Comments
0 comments
Article is closed for comments.