Zendesk is raising the security floor for incoming email.
Beginning September 23, 2026, Zendesk will start automatically enabling its Minimal sender authentication standard for accounts that currently have email authentication disabled. Accounts that already have sender authentication enabled can no longer disable it through Admin Center.
From a security perspective, this makes sense.
From an operational perspective, there is a little more to talk about.
What is changing?
Zendesk uses SPF, DKIM, DMARC and ARC to help determine whether an incoming email is actually coming from the sender it claims to represent.
The new mandatory baseline is the Minimal authentication profile. Zendesk describes this as basic protection for both native and forwarded email, intended to suspend only messages that appear to be blatant spoofing attempts.
This is not Zendesk suddenly requiring every customer who emails your support team to have a perfectly configured enterprise email environment.
Still, authentication is complicated.
Zendesk’s own documentation acknowledges that enabling these protections can result in unauthenticated workflows and even regular senders appearing in the Suspended Tickets queue. Forwarding configurations can create additional complications.
And that is where we think some organizations should be paying particularly close attention.
What if you don’t know who your end users are?
If your Zendesk instance primarily supports employees, known business customers or a well-defined set of domains, authentication failures are usually something you can investigate.
You know the customer. You may know their IT team. You can identify a broken forwarding rule or authentication configuration and work toward fixing it.
But many Zendesk customers don’t operate that way.
They provide support to the general public.
Their next customer might be writing from Gmail. Or a university. Or a small business running its own mail server. Or a municipal system. Or a legacy domain. Or an email that has passed through several layers of forwarding before it ever reaches Zendesk.
In those cases, you don’t control the sender’s mail configuration.
You may not even know they tried to contact you.
That is the piece we don’t want public-facing organizations to overlook.
“No action required” doesn’t mean “no preparation required.”
Zendesk’s announcement says that no action is required for the migration itself. The platform will make the change automatically.
Technically, that’s true.
Operationally, we would treat this differently.
Zendesk specifically recommends monitoring your Suspended Tickets view after enabling sender authentication. Messages that fail authentication can be routed there instead of becoming normal tickets.
And Suspended Tickets are not an indefinite safety net.
Unrecovered suspended messages are automatically deleted after 14 days, at which point they cannot be recovered.
For an organization receiving thousands of messages from known customers, that may be an administrative issue.
For an organization whose Zendesk instance acts as a public front door, it could mean something more important: a legitimate person believes they contacted you, while your support team never realizes there was a conversation to begin with.
What should Zendesk administrators do now?
We are not recommending that organizations try to work around the new security standard. Sender authentication exists for good reason, and spoofing protection is increasingly important.
We are recommending that administrators understand what happens when it goes wrong.
Before September 23, review:
- Your current sender authentication profile
- Whether support email reaches Zendesk directly or through forwarding
- Distribution lists, shared mailboxes and other intermediaries in the mail path
- Current Suspended Ticket volume and suspension causes
- Who is responsible for reviewing suspended messages
- How frequently that queue is being reviewed
- Whether public-facing or high-risk workflows need additional monitoring
This is also a good time to baseline your existing suspension volume. If that number changes after the rollout, you will know quickly that something deserves investigation.
Security controls work best when they are paired with operational visibility.
The bottom line
We support Zendesk’s move toward secure-by-default email handling.
We also think organizations need to understand that “secure by default” changes where certain failures happen.
A message that previously became a ticket may now require attention in the Suspended Tickets queue. When your customers are known, that is manageable. When your Zendesk instance serves anyone who happens to need help, the stakes are different.
September 23 shouldn’t be a reason to panic.
It should be a reason to check your configuration before your customers test it for you.
Get Ready Now Before It’s Too Late
729 Solutions can review your Zendesk email authentication, forwarding architecture and suspended-ticket workflow before the rollout. Schedule a Zendesk configuration review now.
