Workflow: How to effectively prevent and block spam tickets received from anonymous users

<p>An open Zendesk environment, where anyone can submit a request, can also open the gates for unwanted tickets in your account.</p><p>This workflow provides the steps below.</p><p>Open means everyone can access your help center and submit support requests. Some customers choose this setup if they sell products and support the general public. With this option, anyone can submit any type of support request and create new user accounts in your account. For more information about user access, see <a href="https://support.zendesk.com/hc/en-us/articles/4408887573274-Understanding-options-for-end-user-access-and-sign-in" target="_blank" rel="noopener noreferrer">Understanding options for end-user access and sign-in</a></p><p>However, when you keep Zendesk open, anyone can submit requests that don't relate to your business and use any email address to create tickets, all without a proper verification process.</p><p>Abusive actors can use your <a href="https://support.zendesk.com/hc/en-us/articles/4408846805530-Submitting-and-tracking-requests-in-the-help-center-Customer-Portal" target="_blank" rel="noopener noreferrer"><strong>Submit a request</strong></a> form to send messages to third-party email addresses that don’t belong to your customers.</p><p><img class="wysiwyg-image-resized" style="aspect-ratio: 1434/1856; width: 50%;" src="https://support.zendesk.com/hc/article_attachments/9835766480922" alt="" width="1434" height="1856"></p><p>After someone submits a ticket, your first-reply triggers may send notifications with the message details, such as the title and description, to the third-party email address.</p><p>Even if you require help center signin or remove the ticket form from the Submit a request page, anonymous users can still create requests.<br><img src="https://support.zendesk.com/hc/article_attachments/9839708765082" alt="" width="3010" height="938"></p><p>If your account allows anyone to submit tickets, abusive actors can use the <code>api/v2/requests</code> <a href="https://developer.zendesk.com/api-reference/" target="_blank" rel="noopener noreferrer">application programming interface (API) endpoint</a> to programmatically create multiple tickets and bypass restrictions to create relay spam in your account.</p><p>Abusive actors don’t need to use the help center Submit a request page. They can use any API client to submit tickets, enter specific metadata for your form, and use IP rotation to generate multiple spam tickets.</p><div style="margin-bottom: 20px; text-align: right;">
<button id="master-toggle" class="btn fw-semibold text-dark" data-action="expand" style="background-color: #DEF991; border: none; outline: none; border-radius: 7px; padding: 10px 20px; font-size: 15px; transition: background-color 0.2s ease;" onmouseover="this.style.backgroundColor='#cbef6d'" onmouseout="this.style.backgroundColor='#DEF991'">
Expand all tabs
</button>
</div>
<script>
document.addEventListener('DOMContentLoaded', function () {
const toggleBtn = document.getElementById('master-toggle');

toggleBtn.addEventListener('click', function () {
const action = this.getAttribute('data-action');
const headers = document.querySelectorAll('.accordion');

headers.forEach(header => {
const isActive = header.classList.contains('active');
const panel = header.nextElementSibling; // Grabs the corresponding .panel container

if (action === 'expand' && !isActive) {
// Open it by simulating a standard click
header.click();
} else if (action === 'collapse' && isActive) {
// Close it by simulating a standard click
header.click();
}
});

// Flip button text and states
if (action === 'expand') {
this.setAttribute('data-action', 'collapse');
this.textContent = 'Collapse all tabs';
} else {
this.setAttribute('data-action', 'expand');
this.textContent = 'Expand all tabs';
}
});
});
</script><div class="accordion"><h3 id="h_01K833KGVZ12JMQXZYES6QS2KP"><strong>Step 1: Remove placeholders from your account's first-reply triggers</strong></h3></div><div class="panel">
<p>This prevents the relay of spam messages from your account, but it doesn't block the unwanted ticket creation process.</p>
<p>The following placeholders are targets for relay spam because they use an anonymous endpoint that allows anyone to enter any text or links they want.</p>
<ul>
<li data-list-item-id="e2f83c67675fe53e0c65184014625a6f6"><code>{{ticket.title}}</code></li>
<li data-list-item-id="ebb8faee5b148c1dc8dcb3b7b55f426ce"><code>{{ticket.requester.first_name}}</code></li>
<li data-list-item-id="e58a7f6b1a45d1cfaa97e74d46757e4dd"><code>{{ticket.requester.last_name}}</code></li>
<li data-list-item-id="eadaee4a81a5c6c9c9943c6f4b245e8aa"><code>{{ticket.requester.name}}</code></li>
</ul>
<p>To prevent the creation of spam tickets in your account, remove these placeholders and replace them with plain text.</p>
<p>For more information, see <a href="https://support.zendesk.com/hc/en-us/articles/4408832828186#h_667502120121539295305407" target="_blank" rel="noopener noreferrer">Removing specific placeholders from first-reply triggers</a></p>
<div class="p"><div class="note">
<strong>Note:</strong> If you add these placeholders to dynamic rule settings, you must remove or replace them individually in each specific rule.</div></div>
</div><div class="accordion"><h3 id="h_01K833KGW0YCTV5ARCVNV03HVY"><strong>Step 2: Disable the option 'Anybody can submit tickets'</strong></h3></div><div class="panel">
<p>This blocks ticket creation through the methods above, because anonymous users can no longer submit tickets.</p>
<figure><p><img src="https://support.zendesk.com/hc/article_attachments/9835769829530" alt="" width="2336" height="480"></p></figure><p>This change blocks spam and unwanted tickets because it permits only verified users to contact you directly.</p>
<p>Take this step only if your business workflow doesn’t require tickets from all users, such as anonymous users.</p>
<p>For more information on turning off this option, see <a href="https://support.zendesk.com/hc/en-us/articles/4408883658906#topic_h1t_z42_h3" target="_blank" rel="noopener noreferrer">Disabling the 'Anyone can submit tickets' option</a></p>
<p>If your business workflow relies on anonymous users, you need to immediately remove specific placeholders from your account’s first-reply triggers. This prevents your account from relaying spam messages, but it doesn't stop the creation of unwanted tickets.</p>
</div><div class="accordion"><h3 id="h_01M0G604XSR5GV9XHCFGEBM2T9"><strong>Step 3: Block specific email domains</strong></h3></div><div class="panel">
<p>If you need to continue accepting tickets from anonymous users, block the email domains associated with the spam.</p>
<ol>
<li data-list-item-id="e12f4fb7fec168314e06543e2ede88789">In <strong>Admin center</strong>, click <strong>People</strong> in the sidebar, then select <strong>Configuration </strong>&gt;<strong> End users</strong>.</li>
<li data-list-item-id="e5cc0d7fff51b3f97a021c75a9911b367">In the <strong>Blocklist</strong> <strong>field</strong>, enter the domain with the <code>reject:</code> modifier.</li>
<li data-list-item-id="ef2756469cf76c3da4bb58aa5c4d8e553">Click <strong>Save</strong>.</li>
</ol>
<p>For example, to prevent users from the qq.com domain from creating tickets, add:</p>
<pre class="language-auto">reject:qq.com</pre>
<p>You can use the same format to block other domains or individual email addresses, such as <code>reject:example.com</code> or <code>reject:user@example.com</code>.</p>
<p>You can also enable <a href="https://support.zendesk.com/hc/en-us/articles/4408821985818-Authenticating-incoming-email-SPF-DKIM-DMARC-and-ARC" target="_blank" rel="noopener noreferrer">enhanced user authentication</a> if you do not already have it enabled.</p>
<figure><p><img src="https://support.zendesk.com/hc/article_attachments/11154150866202" alt="Enhanced authentication setting.png" width="2352" height="516"></p></figure>
</div><p>For more information, see:</p><ul>
<li data-list-item-id="e7822c6aa6df09dc260ce23d7810cb5f1"><a href="https://support.zendesk.com/hc/en-us/articles/4408832828186#h_667502120121539295305407" target="_blank" rel="noopener noreferrer">Removing specific placeholders from first-reply triggers</a></li>
<li data-list-item-id="eab282f943bbfa84dacbef9bf35fa3182"><a href="https://support.zendesk.com/hc/en-us/articles/4408883658906-Permitting-only-added-users-to-submit-tickets" target="_blank" rel="noopener noreferrer">Permit only added users to submit tickets</a></li>
<li data-list-item-id="e82d7053c985f30f93f608cab97c7b831"><a href="https://www.zendesk.com/blog/spot-phishing-attack/" target="_blank" rel="noopener noreferrer">How to spot a phishing attack</a></li>
<li data-list-item-id="e01c06099a3b3b90b66c60a6523bc202d"><a href="https://support.zendesk.com/hc/en-us/articles/4408833946394-Resources-for-preventing-and-managing-spam" target="_blank" rel="noopener noreferrer">Resources for preventing and managing spam</a></li>
<li data-list-item-id="e844e27d4f3125e58721fcfadd9bdf04d"><a href="https://support.zendesk.com/hc/en-us/articles/4408888782618-General-security-best-practices" target="_blank" rel="noopener noreferrer">General security best practices</a></li>
</ul>