Zendesk Makes Minimal Sender Authentication the New Default

Zendesk is raising the default security level for support desks on its platform. On June 18, 2026, Zendesk announced that its Minimal profile will become the default sender authentication profile. A staged rollout began on September 23, 2026.

The change affects your business in two ways. On your own Zendesk account, sender authentication checks incoming email before it becomes a ticket. It also affects whether emails your employees and systems send to other companies on Zendesk end up in Suspended tickets.

What Zendesk Is Changing

Zendesk is rolling out the change in two phases. In Phase 1, new accounts have sender authentication turned on and set to Minimal by default. In Phase 2, Zendesk moves eligible accounts that have sender authentication turned off to the Minimal profile.

Admins can still choose a stricter profile or turn sender authentication off. Zendesk describes the goal as a secure-by-default model that also reduces persistent email suspension issues.

The change includes a delivery benefit. Under Minimal, Zendesk adjusts spam thresholds for email that passes sender authentication. This reduces the risk of legitimate forwarded email being suspended.

How Zendesk Checks Incoming Email

Zendesk runs every inbound email through sender authentication checks before it creates a ticket. These checks help confirm whether the claimed sender actually sent the message.

Zendesk uses four standards:

Sender authentication always applies to email from agent addresses. Admins can’t turn it off for agents.

The Three Authentication Profiles

Admins can choose from three sender authentication profiles in the Admin Center. Each profile decides which emails become suspended tickets, which pass with a potential spoofing flag, and which become normal tickets.

Minimal is the least strict sender authentication profile and the new default. It suspends an email when SPF fails, and DKIM either isn’t configured or fails. It flags an email when SPF isn’t configured and DKIM fails. Minimal has no DMARC-based suspension rule.

Native traffic adds stricter checks for email sent directly to your native Zendesk address, such as [email protected]. It suspends email that claims to come from one of your verified domains and fails DMARC when that domain's policy is p=quarantine or p=reject. Forwarded email is still checked under Minimal rules.

Native and forwarded traffic extends those checks to auto-forwarded email. Zendesk validates the ARC seals each forwarding server adds. It also reviews the authentication results each server recorded for the original sender.

For stricter sender authentication, Zendesk recommends starting with Native traffic. Admins can move to Native and forwarded traffic once they confirm that legitimate forwarded email isn’t being lost.

When Emails Become Suspended Tickets

Zendesk holds suspended email in the Suspended tickets view and lists "Email authentication failed" as the cause.

Suspended tickets can affect the emails you receive and send.

On your own Zendesk account, suspended tickets can hold back legitimate customer requests. This happens when a sender’s SPF or DKIM is misconfigured, or when an auto-forwarding workflow breaks authentication. Zendesk warns that a suspended ticket isn't necessarily from its claimed sender. Review suspended tickets carefully before recovering them.

On other organizations’ Zendesk accounts, your email can end up in their Suspended tickets view. Under Minimal, email that fails SPF and has no valid DKIM signature is suspended. This is a delivery issue: legitimate support requests, billing queries, and partner communications from your domain don't arrive as normal tickets.

The receiving business controls its sender authentication profile. Your company controls whether its own authentication passes.

How Your DMARC Policy Changes the Outcome

Under Native traffic, the DMARC check applies only to email that claims to come from one of your verified domains. It suspends that email only when it fails DMARC and your policy is p=quarantine or p=reject.

At p=none, the DMARC check doesn’t move email into Suspended tickets. A spoofed email impersonating your domain can still become a ticket. Enforcement gives Zendesk’s DMARC check a policy to act on.

Forwarding adds another consideration. Native traffic checks forwarded email under Minimal, so the DMARC rule doesn’t apply. Native and forwarded traffic extends DMARC checks to forwarded email, using the ARC results each forwarding server adds.

What Zendesk Admins Should Do Next

Authenticate Every Sender with Sendmarc

Zendesk accounts with sender authentication turned on check your email before it becomes a ticket. Critical communications, including billing, notifications, and support requests, need to pass those checks to reach recipients instead of landing in Suspended tickets. Unauthenticated or misconfigured senders put that at risk.

Sendmarc identifies every service sending email from your domain, including unauthorized or unknown senders. This visibility across all email-sending tools shows which senders fail SPF or DKIM, so your team can fix them.

DMARC Management takes your domain through a staged progression from p=none to p=reject, so legitimate email keeps flowing. Monitoring and optimization continue after enforcement, as your sending tools change.

See how Sendmarc authenticates every sender.