Plan requirement
| Subscription | Any plan |
| Access | Agent |
Four warnings can appear on a ticket comment. Each one tells the agent something different, and there is nothing here to switch on: the flags appear on their own, and you cannot remove one once it is there.
| Flag | What it is telling you |
| Potential comment spoof | The comment may not have been sent by the address shown, or email authentication failed. |
| Possible "Reply to end user" spoof | If the agent replies, the reply may not go to the end user shown. |
| Possible "Reply to agent" spoof | If the agent replies, the reply may not go to the agent shown. |
| Possible "Other user update" | An unknown user who is not a CC on the ticket has joined the conversation with a comment. |
A flagged comment carries a warning icon. Clicking it shows the message, and hovering over it gives you the same information without opening anything.
Email only
Flags appear only on ticket comments created from email. They do not appear for messaging, chat, the Web Widget or the help centre request form, so an agent working mostly in those channels will never see one and should not read their absence as a clean bill of health.
What a flag proves
Less than its name suggests, in both directions. Its presence does not guarantee the message was spoofed, and its absence does not mean the sender was authenticated. It is an indicator that the message did not pass the checks, not a verdict.
That is why the flag cannot be removed. It is a record of what the checks found, not a task somebody works through.
What an agent does with one
For an ordinary question, note it and carry on. For anything sensitive (account changes, personal data, refunds, credentials), verify identity another way before acting. Where the message is plainly hostile, mark it as spam and suspend the user, or hand it to whoever handles security in your organisation.
Two flags of the same type clustering on one domain usually mean that company's mail is misconfigured rather than that somebody is attacking you. Telling them is a favour, and it reduces the noise.
Agents have to be told
A marker nobody has explained is a marker nobody reads. Show your team one flagged ticket and give them the one rule that matters: a flag is a reason to verify before doing anything irreversible.
Comments
0 comments
Article is closed for comments.