Setting your allowlist and blocklist

Two lists decide which senders always get through and which never do. They accept domains as well as addresses.

Two lists decide which senders always get through and which never do. They accept domains as well as addresses.

Set the lists

1. Open Admin Center, then People, then Configuration, then End users.
2. Find the allowlist and blocklist.
3. Add addresses or whole domains, one per line.
4. Save.

What each does

• Allowlist. These senders are not suspended. Use it for customer domains that keep getting caught, and for internal systems that send you automated tickets.
• Blocklist. Two keywords decide which: suspend: puts the ticket in the suspended queue for review, and reject: blocks it outright with no record kept. Use it for persistent spam sources.

One thing the screen tells you itself: a domain attached to one of your organisations is allowed by default and cannot go on the blocklist. Zendesk warns you rather than letting you lock out a customer you set up deliberately.

The syntax, and the wildcard

Write a full email address as it is, and a domain without the @. A lone * on the allowlist suspends submissions from all new users except the ones you have allowlisted, which is a strong setting worth reaching for deliberately rather than by accident.

Precedence is worth testing. Zendesk's own pages disagree: one states that the allowlist overrides the blocklist, with the example of allowlisting a user on a blocklisted domain, while another states that it does not and that conflicts default to suspension. If you have an address on one list and its domain on the other, send a test and look at where it lands rather than reasoning it out.

Domains are the useful unit

Allowlisting a customer's whole domain covers everyone who works there, including the colleague who writes to you for the first time next month. Address by address, you are permanently one step behind.

Blocking a sender who is a customer

Occasionally someone abusive needs to be stopped. The blocklist does it, and it is worth recording who decided and why, because a blocked address produces no bounce and no trace on your side. In six months nobody will remember, and a colleague will spend an afternoon working out why that company's mail vanishes.

See also

• Why tickets get suspended
• My customer keeps ending up in spam: what to do