Allowing attachments in tickets

What's my plan?






All Suites

Team, Growth, Professional, Enterprise, or Enterprise Plus









Support

Team, Professional, or Enterprise







Verified AI summary ◀▼


Turn on attachments in tickets to allow agents and end users to share files via email, web forms, and other channels. Configure settings for privacy, file types, and size limits to enhance security and control. You can also allow private attachments for sensitive documents, ensuring only authorized users can access them. Adjust permissions to let end users attach files, enhancing communication and support efficiency.




Location:
Admin Center > Objects and rules > Tickets >
Settings


Agents and end users can send each other attachments through tickets.
Zendesk
Support accepts attachments from users sent in
via the API,
email, web form,
Web Widget, and Web Widget (Classic) channels in your help center.


Administrators can configure how attachments are handled in a number
of ways,
including setting privacy rules, end user permissions, and attachment
methods.

This article includes the following topics:


About email attachments


Allowing agents to attach files in emails


Allowing end users to attach files to tickets


Allowing private attachments


Setting an expiration period for public attachments


Setting allowed file types for attachments


Attachment size limitations




About email attachments


Agents and end users can add attachments when creating or updating
a
ticket, or replying to an email notification. The attachments become
linked attachments, which are links to external
files
that can be used to download the attachments, if and when they’re
needed. This is the default behavior for attachments sent by email
and this is what happens when email attachments are not allowed.


If email attachments are allowed, the behavior
is different.
Agents and end users can send email attachments instead of linked
attachments. Email notifications caused by creating or updating a
ticket, or replying to an email, include actual attachments, instead
of links to attachments. Email attachments appear as images and are
a preview of the first page of the file.


There are two types of email attachments:


Inline attachment: You can
drag and drop files
into the body of an email or comment. The image of
the file appears wherever you dropped the file.


Appended attachment: Attachments
that appear at
the bottom of a comment and that send as part of the
comment's email notification.




Note: If you've set up business rules
to send automated replies to end users
(with placeholders such as
ticket.verbatim_description), any
attachments originally sent by the end user will not be included
in
the automated email notification.


All files attached via email are scanned for malware before being
sent in
an email notification. If an attachment is found to include a virus,
several actions are taken. The attachment:


Isn't included in the email notification. Instead, the
recipient is notified that an attachment wasn't
sent.

Won't be visible within the ticket to end users.

Will be visible within the ticket to agents but labeled
with a malware warning and unavailable for
download.


Will be visible within the ticket to admins but labeled
with a malware warning. Admins can download
potentially malicious attachments and choose to
override the restricted access for agents.




The sender does not receive a notification when an attachment
is not sent.


When email attachment file size limitations are
exceeded, links to attachments appear in email notifications instead
(see
Attachment size limitations).


Note: Some
attachments may initiate Zendesk firewall rules. For
example, if your attachment contains code, the firewall rule
may be initiated. Zendesk recommends you zip or encrypt the
file to bypass this rule.


Here are examples of what attachments look like to agents and end
users.









Situation
Example






Linked email attachment in an email
notification in Gmail account











Email attachment in an email notification in
Gmail account











Attachment in the ticket interface in
Support










Malicious attachment in the ticket
interface in Support (visible only to team
members)











Allowing agents to attach files in emails


The default attachment configuration allows your agents to add files
to
ticket comments and email notifications as links. You can allow
agents to attach files directly to the comment. This type of
attachment is stored in Zendesk Support and is accessible from the
ticket interface. You can attach any file type you want.



Note: The types of
comment
placeholders
you use in ticket triggers can
also affect whether email attachments appear as links. Use
rich text comment placeholders to allow attachments when
Allow agents to attach files in emails
is
turned on.



You can also allow end users to add attachments to tickets (see
Allowing end users to attach files to tickets).


To allow email attachments


In Admin Center, click
Objects and rules in the sidebar, then select Tickets > Settings.


Click Downloads and attachments
to expand
it.


Select
Allow agents to attach files in
emails.

Note: This
setting doesn't appear and can't be turned on if
secure downloads are allowed.



At the bottom of the page, click Save.




Once turned on, when an agent attaches a file to a comment, it is
included as an attachment rather than a link. Only files attached
to
the current ticket comment are included in the email notification.
Files attached to earlier ticket comments are not attached to later
email notifications.


For information about how to send an attachment as an agent, see
Adding attachments to ticket
comments.




Allowing end users to attach files to tickets


You can allow end users to send attachments when filing a ticket
or
responding to an email notification.


The permissions granted to agents, described in
Allowing agents to attach files in emails,
apply to end
users when this setting is configured. Additionally, inline
attachments are available only for signed-in end users.


To allow attachments from end users


In Admin Center, click
Objects and rules in the sidebar, then select Tickets > Settings.


Click Downloads and attachments
to expand
it.


Select
Allow end users to attach
files.


Click Save.






Allowing private attachments


Attachments usually aren't indexed by search engines or included
in
threat intelligence platforms (TIPs) unless their URLs are publicly
shared, like in a help center article or within email notifications
to users. Regular attachments to tickets are secured using a URL
with an attachment token that is considerably complex and random,
but are visible to anyone with the URL and token. When relying on
this type of security, if an email notification is misdirected to
someone other than the intended end user, sensitive information may
be accidentally exposed.


If sensitive documents are attached to your tickets, especially
identification documents such as passports and driver's licenses,
you can allow private attachments. When turned on, agents must be
signed in to view attachments.


End users can see private attachments in their tickets in help center

because they have to sign in to view their tickets. However, the
attachments
will appear as links in email tickets. They'll need to click the
links and sign in
to the help center to view the attachments.

Note the following about allowing private attachments:


Private attachments can only be used if Guide is activated. If
Guide isn't activated, private attachments prevent end users
from downloading attachments since they can't be
authenticated.


If you allow private attachments, it will disable inline images
for users who aren't signed in, and it will also prevent
agents and admins from being able to add inline images in
Support. Inline images are disabled only for Zendesk hosted
images and not images that are publicly accessible.


When an attachment is associated with a ticket, visibility is
restricted to users with access to the ticket.


In the Zendesk Agent Workspace, this setting also applies to
attachments sent as part of a live chat, but it does not
apply to web, mobile, or social messaging attachments (see
Securing chat
attachments in the Zendesk Agent
Workspace).


To allow private attachments for messaging, see
About private
attachments in messaging.




Note: Access controls should be
implemented to
ensure only authorized personnel can view sensitive
attachments, and staff should be educated on the importance
of data security and the proper handling of attachments. See
General security best
practices
for more information about keeping
your Zendesk account secure.



To allow private attachments



In Admin Center, click
Objects and rules in the sidebar, then select Tickets > Settings.


Click Downloads and attachments
to expand it.


Select Allow secure downloads.

Note:
Allow agents to
attach files in emails
doesn't appear and
can't be turned on if secure downloads are allowed.
Additionally, when you turn on secure downloads,
agents can't copy and paste images from their
computer into ticket comments.



Click Save.





Setting an expiration period for public attachments


Admins can turn on an expiration period for public attachments.
Attachment expiration allows attachments to remain publicly
accessible for a designated period, after which they become private
and require user authentication to access.


Attachment expiration for public attachments provides an alternative
to
private
attachments,
which require end users to authenticate
before accessing attachments. This feature is particularly
beneficial for organizations with large end-user bases that prefer
not having authentication barriers for attachment access.


By default, attachments remain publicly accessible for 24 hours.
When the
expiration period lapses, attachments function as private, requiring
user authentication for access.


This feature doesn't apply to images attached to macros or embedded
within macro comments.


To turn on an expiration period for public attachments



In Admin Center, click
Objects and rules in the sidebar, then select Tickets > Settings.


Click Downloads and attachments
to expand it.


Select Attachment expiration.

Note:
Attachment expiration is hidden
if
Allow secure downloads is turned
on.



In the Hours field, enter the number of hours to keep
attachments public. After this time period, the attachment
can only be accessed through a secure link that requires
sign-in.


Click Save.





Setting allowed file types for attachments


By default, when ticket attachments are turned on, attachments are
restricted to a recommended list of commonly used file extensions
that are generally considered safe. This helps protect your account
from potentially harmful files such as .exe attachments, which are
often exploited in security attacks.


Note: If your account was created
before August 13,
2025, all attachment file extension types are allowed by
default.


The list of recommended file types includes the following file
formats:


har, json, 3g2, 3gp, 7z, aac, amr, avi, bmp, csv, doc, docx, eml,
gif, heic, heif, ics, jfif, jpeg, jpg, key, log, m4a, m4v,
mov, mp3, mp4, mp4a, mpeg, mpg, mpga, neon, numbers, odt,
oga, ogg, ogv, opus, pages, pdf, png, pps, ppsx, ppt, pptx,
qt, svg, tif, tiff, txt, vcf, wav, webm, webp, wmv, xls,
xlsx, xml, yaml, yml, zip


You can change this setting to allow all file types or create a custom
list of allowed file types. When you change the setting, existing
tickets and attachments are not affected retroactively.


File type restrictions apply to files attached to new tickets created
through these channels:



Email

Help center Submit a request form

Zendesk Support mobile app
Web Widget (Classic)



When attachment file types are restricted, agents receive an error
message if they attempt to attach a file with a disallowed
extension, a mismatched file type and extension, or a missing file
extension.





End users don't see an error if they attach a disallowed file. Instead,
a
ticket is created without the attachment. Agents see a warning in
the ticket conversation and
ticket events
that
explains why the attachment wasn't included. This is true even if
the disallowed file was the only content in the ticket.



Zendesk Support mobile app limitations




The Zendesk Support mobile app doesn't recognize allowed file
type settings. The app always accepts the following file
types:


bmp, csv, dib, doc, docx, gif, heic, heif, hif, icns,
ico, jpe, jpeg, jpg, key, numbers, odt, pages, pdf,
png, pps, ppsx, ppt, pptx, svg, svgz, text, tif,
tiff, txt, webp, xls, xls



To set allowed file types for attachments



In Admin Center, click
Objects and rules in the sidebar, then select Tickets > Settings.


Click Downloads and attachments
to expand it.


Select an option for Allowed file types:


All file types: No restrictions.


Only recommended file types:
Restrict
file attachments to a suggested list of commonly
used file types that are generally considered
safe. Zendesk recommends this option.


Only use these file types:
Create a
custom list of allowed file types.




If you selected
Only use these file types, list
the
allowed file extensions, separated by commas, without
periods. Example: pdf, jpg, png


If you selected All file types
or
Only use these file
types,
you must select the
I agree to the
potential security risk involved by allowing
all/only these file types and extensions
checkbox to continue.


Click Save.





Attachment size limitations


Email and web form attachment limits are as follows:


The inbound email and web form attachment limit for a
single file is 50 MB. If a file attachment exceeds
50 MB, the ticket is created without the
attachment.


The outbound email attachment limit for a single file is
7 MB. When this limit is exceeded, Support will
process the attachment as a linked attachment
instead.


The total of all outbound email attachments cannot
exceed 10 MB. When these limits are exceeded,
Support will process the attachment as a linked
attachment instead.


The outbound email attachment limit for a single
linked file is 50 MB. Up to 500 files
can
be attached.

If you try to attach a file larger
than 50 MB, an error message will display and
inform you that the file is too large. The
attachment will not be attached to the ticket (as
either an email or linked attachment).



When you upload GIF files with a large number of frames,
the upload might fail with a timeout error. If this
occurs, try recreating the GIF file with fewer
frames.




For more information about attachment types, see
About email attachments.


Attachments from earlier comments are included in email
notifications as linked attachments. If you add multiple attachments
to a reply, the attachments are prioritized based on the attachment
type and size. Inline attachments take precedence over appended
attachments when calculating size limits. Note that when inline
attachments are sent as links, they still appear as images in the
body of the email notification.

The scenarios below describe how this works.

Scenario 1


Two files are attached in the following order:

Email attachment A (3 MB)
Email attachment B (6 MB)



Behavior:

Files A and B are included as email attachments.



Scenario 2


Three files are attached in the following order:

Inline attachment A (5 MB)
Email attachment B (5 MB)
Email attachment C (4 MB)



Behavior:

Inline attachment A is sent as an email attachment.

Attachments B and C are included as file links, as they
push the total email attachment file size over 10
MB.




Scenario 3


Three files are attached in the following order:

Inline attachment A (5 MB)
Inline attachment B (6 MB)
Inline attachment C (4 MB)



Behavior:

Attachment A is included as an email attachment.

Attachment B is included as a file link, as it pushes
the total email attachment file size over 10 MB.


Attachment C is included as a real attachment, as it
brings the total email attachment file size to 9 MB.






//
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//


//
const banner_style = document.createElement('style');
banner_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-wmp-link{text-align:right;font-size:.8em}#article-body .article-banners{margin-bottom:1rem}#article-body .article-banner{border:1px solid #ded7ca;background-color:#f6f0e6;margin:0 0 3px;line-height:1}#article-body .article-banner table{border-collapse:collapse;border:none;margin:0;width:auto}#article-body .article-banner td{padding:8px 6px 8px;border:none;font-size:.85em}#article-body .article-banner td:nth-child(2){border-left:1px solid #d0c9bd}#article-body .article-banner strong{font-weight:400;text-shadow:0 0 1px rgba(0,0,0,.5);letter-spacing:.5px}@media (min-width:1600px){#article-body .article-banner td{font-size:.8em}#article-body .docs-wmp-link{font-size:.7em}}`;
document.head.appendChild(banner_style);