How Do You Stop Spam in Zendesk? Spam Filter, Suspended Tickets, Relay Spam and AI Options (2026)

Yes, Zendesk has a built-in spam filter, and it runs whether or not you configure it: inbound email rated 99% or more likely to be spam is rejected, everything rated lower lands in the Suspended tickets queue, and unreviewed suspended tickets are deleted after 14 days. To stop relay spam, replace four placeholders in your first-reply trigger with static text. To cut the junk flood, tighten end-user access, use reject: in the blocklist and require authentication on the request and uploads APIs. For a small team that is often enough. What gets past it is mail that looks legitimate: cold sales pitches, vendor "partnership" offers and auto-replies without the usual headers. For those you can add keyword triggers, Zendesk's intelligent triage topics (the Copilot add-on, $50 per agent per month), the free ZeroSpam app, eesel AI or Macha, from $299/month for 750 tickets with setup done for you. Every setting below was checked against Zendesk's documentation on October 8, 2026.

What kinds of Zendesk spam are there, and which is worse?

Three shapes reach a Zendesk queue, and each has a different fix.

• The junk flood. Thousands of fake requests bury real customer tickets. Access settings, the blocklist and API authentication stop most of it.
• Relay spam. An attacker submits a ticket using somebody else's email address, your auto-responder fires, and that person receives a message from your domain carrying whatever subject the attacker typed. The fix is one trigger edit.
• Legitimate-looking noise. Link-building offers, outsourcing pitches, event invitations and auto-replies from other companies' help desks. They pass every spam check because they are real mail from real senders, so they need triggers or an AI layer.

Relay spam is the one that damages you. In October 2025, KrebsOnSecurity received thousands of ticket notifications in a few hours bearing the names of Zendesk customers including CapCom, CompTIA, Discord, NordVPN and Tinder, and Zendesk's communications director told Krebs the mail came from accounts "that configured their Zendesk instance to allow anyone to submit support requests, including anonymous users" (full report). It isn't CVE-2024-49193, a separate email-spoofing bug patched in 2024. Relay spam is a configuration outcome, so the incentive to fix it sits entirely with you. Nobody else pays for your domain's reputation.

The problem hasn't gone away. Spam is a recurring topic on r/Zendesk: our search found 14 spam threads, 9 of them in the 12 months before September 2026, and by August admins were solving spam with marketplace AI apps.

How does Zendesk's built-in spam filter work?

Every inbound email gets a spam score. Per Zendesk's suspended tickets overview, mail rated a 99% or higher chance of being spam is rejected outright and can't be recovered. Below 99%, it's suspended so a person can confirm it.

Spam score is only one of 24 suspension causes on Zendesk's causes for ticket suspension list. The ones that matter for noise:

• Automated response mail. Zendesk reads headers such as Auto-Submitted, Precedence, X-Autoreply and X-Autorespond and suspends what they mark as machine-sent.
• Automated response mail, out of office. Vacation replies are suspended. Per Zendesk's allowlist and blocklist guide, a subject containing "Out of office" is suspended even when the sender is on your allowlist.
• Detected as email loop, Email for "noreply" address, Malicious pattern detected and Malware detected.

An auto-reply sent without those headers, or titled "Automatic reply" instead of "Out of office", arrives as an ordinary ticket. So does every human-written sales pitch.

To review the queue, click Views, then Suspended tickets. Since a May 2026 redesign a Filter link narrows it by cause, sender email and subject. Select tickets, then choose Auto recover, Recover manually or Delete permanently. A recovered ticket returns unassigned with a New status. If nobody owns that queue, turn on digests under Admin Center, Objects and rules, Tickets, Settings, Assignments and notifications: Suspended ticket notifications can go out every 10 minutes, hourly or daily to an email list you set. Our guide to Zendesk suspended tickets covers the review routine in more depth.

How do I stop Zendesk sending relay spam from my domain?

This fix stops strangers receiving mail from your domain, and it takes five minutes.

1. In Admin Center, click Objects and rules, then Business rules, then Triggers.
2. Open Notify requester and CCs of received request (the name varies; you want the trigger that fires on ticket creation).
3. In the subject and body, replace these four placeholders with static text: {​{ticket.title}}, {​{ticket.requester.first_name}}, {​{ticket.requester.last_name}} and {​{ticket.requester.name}}.
4. Check that the trigger carries the condition Current user · Is · (end user). Zendesk's standard version ships with it. It limits the trigger to tickets opened by end users rather than agents, but it doesn't stop relay spam on its own, because an anonymous submitter becomes an end user too. Step 3 does that.
5. Save.

The list is those four placeholders, not {​{ticket.description}}, per Zendesk's tips to combat spam. The restriction applies to the first-reply trigger only. Later notifications can keep their placeholders, because by then a real conversation exists.

Should I turn off anonymous ticket submission in Zendesk?

Relay spam needs an anonymous endpoint. Closing it ends the problem outright, at the cost of friction for customers who write in without an account. In Admin Center, click People, then Configuration, then End users. Three settings matter:

• Anybody can submit tickets. On keeps you open. Off means only users you add can submit.
• Verify anonymous requests. Keeps the endpoint open but sends an unverified sender's mail to the suspended queue instead of the ticket queue.
• Allowed email domains. Restricts submission to domains you name, per Zendesk's guide to permitting only approved email addresses.

Each one trades spam tickets for suspended tickets. Zendesk says so directly: tighter submission means a bigger suspended queue, and someone has to review it before the 14-day auto-delete. Pick the trade deliberately.

Does the Zendesk blocklist block spam on every channel?

Only with a keyword. Per Zendesk's allowlist and blocklist guide (updated June 2026), a bare domain on the blocklist suspends mail from it, and only on the email channel. The help center form, the API and the Web Widget ignore bare entries. Enter these under People, Configuration, End users:

• reject:megaspam.com blocks support requests from that domain on every channel. Nothing reaches the suspended queue and no record is kept. An address that already has a user profile isn't affected; suspend or delete that user instead.
• suspend:megaspam.com sends them to the suspended queue for review, again on every channel.
• * on its own suspends every new email sender except those on your allowlist. Other channels ignore the wildcard.
• Domains go in without the @, separated by spaces, up to 10,000 characters per field. A domain also covers its subdomains.

Four behaviors to know before you build a wildcard strategy. The allowlist overrides the blocklist. If suspend: and reject: conflict, Zendesk suspends, so * reject:gmail.com suspends Gmail rather than rejecting it. A wildcard doesn't catch users whose domain is mapped to an organization; naming the domain does. And the allowlist doesn't stop suspension: an allowlisted sender whose mail fails sender authentication, or whose subject says "Out of office", is still suspended.

Does the Zendesk help center have its own spam filter?

Yes, and it's a different filter. If you run a community or allow comments on articles, Zendesk screens new and edited end-user posts and comments and sends anything that looks like spam to a spam queue instead of publishing it, per Using the spam filter to prevent spam in your help center. It's on by default and can't be disabled, and a Knowledge admin manages the queue under Moderate content, where each item can be deleted, published as not spam, or removed along with its author by suspending the user. Click Follow there to get an email when something is waiting; the queue is checked every two hours, and anything left unreviewed is deleted after 30 days. The filter learns from what you mark as spam. Zendesk's help center spam overview lists the other layers: word moderation, rate limits on new posts, automatic blocking of known spammer IP addresses, and CAPTCHA at sign-up.

How do I stop spam that arrives through the API or web forms?

In Admin Center, click People, then Configuration, then End users, and in the "Anybody can submit tickets" section turn on Require authentication for request and uploads APIs. Check what depends on anonymous submission first. Per Zendesk's spam prevention article, this blocks anonymous ticket creation from the Web Widget contact form, custom apps and external web forms. Turning it on without checking is how a working contact form goes quiet.

You don't need to add a CAPTCHA: Zendesk's Cloudflare bot detection is on by default and can't be turned off, though it only challenges traffic Cloudflare flags. The useful second layer is email authentication: SPF, DKIM and DMARC protect your domain outbound, and Sender Authentication under Admin Center, Channels, Email routes inbound DMARC failures to the suspended queue.

How do you filter sales pitches and auto-replies that get past the spam filter?

Start with a keyword trigger. It's free, it runs at ticket creation before your auto-responder, and it catches the predictable half: auto-replies titled "Automatic reply", "Auto-reply" or "Out of office" that came in without headers, plus pitches with telltale phrases like "guest post" or "backlinks".

1. In Admin Center, go to Objects and rules, Business rules, Triggers, and click Create trigger.
2. Conditions (all): Ticket · Is · Created and Ticket > Subject text · Contains at least one of the following words with your list.
3. Actions: add a tag such as spam_filtered and set Status category to Solved.
4. Add Tags · Contains none of the following · spam_filtered to your received-request notification so filtered senders don't get a receipt, and place the spam trigger above it in the list.

Keyword rules miss anything phrased like a question: "Quick question about your store's Google rankings" contains no word you could safely block.

Zendesk's own AI classification gets closer. Intelligent triage tags each new ticket with a topic, and its prebuilt list includes Misc::Unsolicited::Spam, Misc::Unsolicited::Marketing campaign or newsletter, Misc::Unsolicited::Event invitation and Misc::Unable to receive message::Out-of-office reply. Our d3v-macha sandbox has classification on, and on the synthetic tickets we created for this guide it labeled a link-building pitch "Marketing campaign or newsletter" at medium confidence and an out-of-office reply "Out-of-office reply" at high confidence. Both are usable signals. The gate is the price: classification is included on Suite and Support Professional and above, but acting on it in a trigger needs the Copilot add-on, listed on Zendesk's pricing page at $50 per agent per month billed annually on October 8, 2026. A 10-agent team pays $500 a month for it, though Copilot also buys auto assist and other agent tools. Our intelligent triage guide walks through the setup, including the error Zendesk shows when you try to save a topic trigger without the add-on.

Whatever does the tagging, never let it delete or mark as spam. Tag and solve: a solved ticket reopens if the sender writes back.

Which AI tools filter spam in Zendesk?

Three are worth a look beyond Zendesk's own triage, at very different points on control and cost.

ZeroSpam by SiteSage. A free Zendesk Marketplace app built for online stores. Its listing says new tickets are checked on arrival, spam is tagged and moved into a ZeroSpam view, and a wrong call is fixed with one click. The trade-off is control: you get its definition of spam, not yours. For generic junk and fake orders, try it first.

eesel AI. A self-serve AI layer whose Zendesk integration can tag, close, update fields and leave internal notes, all driven by instructions you write. Pricing on October 8, 2026 started at $299 a month for 500 credits, one credit per ticket. You build and tune the rules yourself.

Macha. An AI agent layer that runs on the help desk you already use (Zendesk, Freshdesk, Gorgias, Front, HubSpot or Intercom). You describe what counts as noise for your business in plain language, the agent tags it and writes a one-line note quoting the sentence it decided on, and Zendesk's own trigger does the solving. It's the done-for-you option: the Macha team builds and tests the agent on your Zendesk, with a dedicated success manager on the trial and every plan. On price, $299 gets you 750 tickets on Macha and 500 on eesel: $0.40 a ticket against $0.60, with setup done for you included (see pricing and how Macha connects to Zendesk).

The incentive cuts both ways here. Any per-ticket tool charges you to screen junk, so 300 pitches a month costs about $120 on Macha. That's the reason to stack the free layers underneath: every domain you reject: is a ticket nobody pays to read.

How does Macha filter spam in Zendesk? A live test run

We built this on October 8, 2026, in our Macha Demo workspace connected to our Zendesk sandbox, d3v-macha. The agent, "P10-16 Zendesk spam and auto-reply filter", has three Zendesk tools: Get Ticket, Update Ticket Tags and Add Internal Note. It was left inactive with no trigger attached. This is the instruction, verbatim:

You screen new Zendesk tickets for spam and automatic mail before a person sees them. You never reply to the sender.

1. Read the ticket with Get Ticket: the subject, the first message and the requester's email address.

2. Decide which one of these three it is:
- vendor_pitch: someone selling something to us, such as SEO or link building, app or website development, lead lists, guest posts, outsourcing or "partnership" offers, with no question about an order, product or account of ours.
- auto_reply: a message a machine sent, such as an out-of-office or vacation notice, a "we received your request" confirmation from another company's help desk, or a delivery or read receipt.
- customer: anything from a customer or a possible customer about our products, orders, shipping, returns, billing or their account. Someone who wants to buy from us is a customer, even if they call it a partnership. If you are unsure, it is customer.

3. vendor_pitch: add the tags spam_filtered and spam_vendor_pitch, then add a one-line internal note that starts "Filtered as vendor pitch:" and quotes the sentence that shows it.

4. auto_reply: add the tags spam_filtered and spam_auto_reply, then add a one-line internal note that starts "Filtered as automatic reply:" and quotes the sentence that shows it.

5. customer: add the tag spam_checked_real. Don't add a note.

A Zendesk trigger solves every ticket tagged spam_filtered, and a solved ticket reopens if the sender writes back. Never delete a ticket, never mark it as spam and never suspend the requester.

The solving lives in Zendesk, in a trigger we created called "Solve tickets the spam filter tagged": Ticket is Updated, Tags contain spam_filtered, Status category less than Solved; action, Status category Solved. Splitting it this way keeps the rule visible to every admin, with a practical upside. Our sandbox makes two fields required before a ticket can be solved, and Zendesk enforces that on API updates, while the trigger solved our test tickets without them.

We used the agent's Test run, which creates a real ticket in d3v-macha and runs the agent as if its ticket-created trigger had fired. Four synthetic emails:

The fourth email is the one we wrote the test around. Its subject says "Partnership inquiry", the phrase most keyword filters block, but the sender wants to buy 40 throws. The instruction's line about buyers did its job, and the ticket stayed with a person. Zendesk's own triage labeled the same email "Available services", also correct.

We also ran the agent from the dashboard chat on tickets we had created through the Zendesk API; in chat, each Zendesk write waits for a teammate to press Confirm. Below is the pitch afterwards: the agent's note quoting the line it decided on, the tags, and Solved in the header. The topic under the subject is Zendesk's intelligent triage label.

One limit is by design. The agent runs after the ticket exists, so your received-request notification has already gone to a pitch by the time it's filtered. If receipts to vendors bother you, keep the keyword trigger above for the obvious cases; it runs first. To review, we built a view called "Spam filter: review daily" on Tags contain spam_filtered. Reading five subjects takes seconds.

How do I delete thousands of spam tickets already in Zendesk?

Prevention does nothing about junk already in your account. Four routes, with their limits:

An automation acts on at most 1,000 tickets per hourly run, so 30,000 spam tickets take a minimum of 30 hours.

Mark as spam moves the ticket to Deleted tickets for 30 days and suspends the requester, so they can't submit tickets or reach your help center. If your external contact form forwards submissions in by email, never mark those tickets as spam: you'd be flagging your own form, which can get your sending domain blocklisted. Use bulk delete instead.

How do I stop receiving Zendesk spam from other companies?

You can't fix another company's configuration, but you can filter on the header every Zendesk notification carries. A Google Apps Script shared on GitHub that runs hourly, checks recent mail for an X-Mailer header containing "zendesk" and applies a label a Gmail filter can archive. It labels every Zendesk email, including companies you actually use, so archive rather than delete.

Which Zendesk spam option should you choose?

• If your spam is junk and fake requests, the native settings above are enough. Add ZeroSpam if some still gets through; it costs nothing.
• If you already pay for Copilot, use the unsolicited intelligent triage topics in a trigger.
• If you get a steady stream of pitches and auto-replies and want your own definition of noise, an AI layer is the right tool. Choose eesel if you want to build and tune it yourself.
• If you'd rather not build it, Macha's team sets it up on your Zendesk and keeps tuning it, at about $0.40 a ticket, which includes setup and a dedicated success manager who handles your changes. The same agent can then draft replies to the real tickets it leaves.

How do you roll out an AI spam filter without losing real tickets?

1. Run it tag-only for a week. Leave the solve trigger off and check every spam_filtered ticket by hand.
2. Bias the instruction toward "customer". A pitch that reaches a person costs a few seconds; a buyer filed as spam costs a sale.
3. Make the decision visible. A quoted sentence in a note turns a false positive into a one-line fix to the instruction.
4. Switch on the solve trigger, then keep the daily review view. Count reopened spam_filtered tickets each week; that's your false-positive rate.
5. Block repeat senders natively. When the same domain shows up three times, reject: it and stop paying to screen it.

If tickets aren't arriving at all, the problem is upstream, and our guide to Zendesk email not creating tickets is the place to start. If your own replies land in customers' spam folders, see why Zendesk emails go to spam. For the rule engine itself, Zendesk triggers explained covers conditions and actions, and our Zendesk automation hub lists the other tasks an agent can take on.

Frequently asked questions

Does Zendesk have a spam filter? Yes, on every plan, with nothing to configure. It rejects email rated 99% or more likely to be spam, suspends lower-scored mail and auto-replies for review, and deletes suspended tickets nobody reviews within 14 days. Your help center has a separate filter for community posts and comments.

Can Zendesk automatically close spam tickets? Yes, with a trigger. A trigger can tag and solve tickets whose subject contains words you list, or whose intelligent triage topic is spam if you have the Copilot add-on. Solve rather than delete, so a misfiled customer who replies reopens the ticket.

Can Zendesk AI detect spam? Intelligent triage has prebuilt topics including Misc::Unsolicited::Spam, Marketing campaign or newsletter, and Out-of-office reply. Classification is included on Professional plans and above; using a topic in a trigger needs Copilot at $50 per agent per month. In our test it labeled a link-building pitch "Marketing campaign or newsletter", not Spam.

How do I stop out-of-office replies creating Zendesk tickets? Most never do: Zendesk suspends mail with auto-reply headers and any subject containing "Out of office". For the rest, add a trigger on subject words such as "Automatic reply" that tags and solves them, or an AI layer that recognizes them from the body.

Why is my company sending spam emails through Zendesk? Your account allows anonymous ticket submission and your first-reply trigger echoes the subject or requester name. An attacker files a ticket with a victim's address, and your auto-responder sends that victim a message from your domain carrying the attacker's text. Removing the four placeholders from that trigger stops it.

What does marking a ticket as spam do? It moves the ticket to Deleted tickets for 30 days and suspends the requester, who can then no longer submit tickets or reach your help center. For anything automated, tag and solve instead.

How we researched this

We read the Zendesk articles listed below on October 8, 2026 (the causes-for-suspension list was last edited October 1, 2026). Copilot and Suite prices come from zendesk.com/pricing and eesel's from eesel.ai/pricing, read the same day. ZeroSpam's claims are its own listing text; we didn't install it. The worked example ran on October 8, 2026, in our Macha Demo workspace and d3v-macha Zendesk sandbox, with synthetic emails from example.com addresses. Timings come from Zendesk's audit log, creation to tag update. The $120 figure is 300 × $0.40. The Triggers, End users and blocklist screenshots date from September 20, 2026, and one image shows Zendesk's documentation. We didn't reproduce a relay attack, so that mechanism is documented rather than observed.

Sources: Understanding suspended tickets and spam · Causes for ticket suspension · How can I prevent and manage spam in Zendesk? · Tips to combat spam · Setting your allowlist and blocklist · Understanding the allowlist and blocklist · Viewing, recovering, and deleting suspended tickets · Setting up suspended ticket notifications · Marking a ticket as spam · About intelligent triage · Help center spam filter · ZeroSpam on the Zendesk Marketplace · eesel AI Zendesk integration · KrebsOnSecurity, October 17, 2025 · CVE-2024-49193