Plan requirement
| Subscription | Any plan |
| Access | Agent |
Suspended mail never becomes a ticket. Zendesk holds it in a separate list where it waits for someone to look, and unrecovered suspended tickets are deleted automatically after 14 days. You find the list under Views in the sidebar, as Suspended tickets.
Every suspended item carries a cause. Below is what each one means, in the wording you see on screen.
The list has a Filter button, and one of the things you can filter on is the suspension cause, alongside sender address and subject. That is what makes this table worth having open: find the cause here, then filter the list down to it and deal with that group in one pass instead of reading two hundred rows.
Spam and malice
| Cause as shown | What it means |
Detected as spam |
Flagged by the spam filter, or sent by a suspended user. |
Malicious pattern detected |
A pattern matching spam or phishing. |
Malware detected |
Possible malware or malicious URLs. |
Sender or domain is on the blocklist |
The address or the domain is on your blocklist. |
Sender domain not on allowlist |
The domain is not on your allowlist. |
Automated mail and loops
| Cause as shown | What it means |
Automated response mail |
Recognised from the headers as an automated reply. These cannot be unsuspended. |
Automated response mail, out of office |
An out of office reply. |
Detected as email loop |
More than 20 emails from the same user within an hour: the next 20 are suspended, and beyond 40 further updates that hour are rejected without even becoming suspended tickets. A matching reply-to address triggers it too. |
Received from support address |
Mail from your own support address. Always suspended to prevent mail loops. |
Email for 'noreply' address |
A no-reply address, not meant to be answered. |
Detected email as being from a system user |
Mail from a mail server, such as mail-daemon@ or postmaster@. |
Permissions and registration
| Cause as shown | What it means |
Permission denied for unknown email submitter |
An unknown sender on an account that only accepts known users. |
User must sign up to submit email, user notified |
Registration is required, and the sender has been notified. |
End user only allowed to update their own tickets |
A reply from a different address than the one that submitted the ticket. |
User does not have authority to update the ticket |
Updated by somebody who is neither the requester nor a CC. |
Permission denied due to unauthenticated email update |
The email token is missing from the headers. |
Anonymous request |
An anonymous help center submission still awaiting confirmation. |
Submitted by unverified user |
A known user who has not verified their email address. |
Submitted by unverified account owner |
The account owner has not confirmed the account creation email. |
Authentication
Expect more of these from 23 September 2026. From that date Zendesk switches authentication on for accounts that had it off, at the Minimal level, and forwarded mail is the traffic that most often fails it. It is a staged rollout rather than a single day, running on into the autumn, so a rise weeks later counts too. If suspensions climb in that window, this is the reason rather than a change at your end.
| Cause as shown | What it means |
Failed email authentication |
The mail did not pass DMARC authentication. |
Email authentication failed |
A spoofed sender, or the domain fails DMARC, SPF or DKIM. |
Limits and technical
| Cause as shown | What it means |
CCs/followers limit reached |
More than the maximum of 48 email addresses in the CC. |
Email is too large |
The message exceeds the maximum size. |
HTML attributes per element limit exceeded |
Too many HTML attributes in the email. |
Automatic email processing failed |
A rare processing error on the system side. |
Why real customers end up here
Usually through Permission denied for unknown email submitter or one of the two authentication causes. A customer writing from a new address, on an account that only accepts known users, is suspended. So is a customer whose own mail provider has its records set up wrongly, which is not their fault and is invisible to them.
Both fail silently from their side: they sent an email and heard nothing. Their next contact is usually an annoyed one, which is why a list nobody reviews is a queue of customers who believe they were ignored.
What recovering does
A recovered ticket arrives unassigned with the status New, and shows up in views for unassigned tickets. Its via field reads System or Email rather than an agent name.
Access differs by plan: on standard plans an agent needs permission to view all tickets, and on Enterprise it takes a custom role with permission to view, recover and delete suspended tickets. Admins always have it.
Comments
0 comments
Article is closed for comments.