Plan requirement
| Subscription | Any plan |
| Access | Admin |
Zendesk can check SPF, DKIM, DMARC and ARC on every incoming message and suspend the ones that fail. From 23 September 2026 this is no longer optional, so learn what the setting does before it arrives on its own.
Set the protection level
- In Admin Center, click Channels in the sidebar, then select Talk and email > Email.
- Turn on Authenticate emails received with SPF, DKIM, and DMARC alignment.
- Choose the level of protection.
- Watch the Suspended tickets view for a fortnight before you tighten it further.
| Level | What it checks |
| Minimal | Baseline protection for both native and forwarded email, suspending only clear spoofing attempts. |
| Native traffic | Mail sent directly to your Zendesk support addresses. |
| Native and forwarded traffic | Also checks forwarded mail, using the ARC headers and authentication results the forwarding server added. |
What happens to a message that fails
It is suspended, not deleted. You find it in the Suspended tickets view with Failed email authentication as the cause.
Recover those with care. The whole point of the flag is that the message may not be from the sender it names, so recovering it into a ticket puts a forged message in front of an agent with nothing left to warn them.
Two dates that decide this for you
18 June 2026. For accounts that already have authentication on, the control to switch it off was removed from Admin Center.
23 September 2026. For accounts that still have it off, Zendesk begins switching it on automatically at Minimal. That is the start of a staged rollout and not a single moment, so your account may change days or weeks later. Zendesk dates the end of it twice and differently, 22 October in its own table and 16 December in the text beside it, so treat the whole autumn as the window. Nothing happening on the 23rd is not the same as being exempt.
If your account is in the second group, the useful preparation is to enable it yourself now and read your suspended tickets for a few weeks, so that any legitimate sender whose records are wrong turns up while you are looking rather than on the morning it happens by itself.
It also suspends fewer legitimate messages
Easy to miss in all the talk about suspension: mail that passes authentication is judged less harshly by the spam filter afterwards. Forwarded mail from a legitimate sender is exactly what used to get caught, so switching this on can leave you with fewer wrongly suspended tickets rather than more.
That is why the sensible order is native traffic first, watch, then forwarded. You are not tightening a screw; you are teaching the filter which senders to trust.
What it does not do
It proves the sending server was authorised for that domain. It does not prove who typed the message, so a genuine but compromised mailbox passes every check. And a domain that publishes no records of its own gives the check nothing to compare against.
Tell your agents what a suspension and a flag mean, because the setting only helps if somebody acts on what it produces. Our support desk can look at your suspended tickets with you if the pattern is unclear.
Comments
0 comments
Article is closed for comments.