Included on every account, at no charge.
1. What This Feature Does
Two-factor authentication (2FA) asks for a second proof at sign-in, after your password: a 6-digit code from an authenticator app on your phone or computer. Someone who learns your password still cannot sign in without it.
When you turn 2FA on you also get ten backup codes. Each one signs you in once in place of an authenticator code — your way back in if you lose your phone.
2. When You Should Use It
- Always, on any account that controls DNS, email authentication or billing.
- Especially if you have reused your password anywhere else, or sign in from shared computers.
3. When You Should Not Use It
- Scripts that sign in with your password. They cannot supply a code once 2FA is on. Use an API key instead; keys do not ask for a code.
- Several people sharing one login. Everyone would need the same authenticator and the same backup codes. Give each person their own account instead.
4. Prerequisites
- An authenticator app that supports time-based codes (TOTP) — for example Google Authenticator, Authy, Microsoft Authenticator, 1Password or Bitwarden.
- A safe place for the backup codes that is not the same device as your authenticator.
- Your account password, to turn 2FA off later.
5. How It Works (Brief)
Setting up shares a secret between CertaDNS and your authenticator app, through a QR code. From then on the app shows a new 6-digit code every 30 seconds, and CertaDNS works out the same code from the same secret. A code is accepted for 30 seconds either side of its own window, to allow for small clock differences.
Backup codes are 8 characters long, using the digits 0–9 and the letters A–F. CertaDNS stores them only in hashed form, so they are shown to you once, at setup. Each code is crossed off when it is used.
6. How to Use It
2FA is in Settings > Security, under Two-Factor Authentication.
Turn on 2FA
- Click Enable 2FA.
- Step 1: Scan QR Code — scan the code with your authenticator app. If you cannot scan it, type in the key shown under Can't scan? Enter manually; the copy icon copies it. The entry appears in your app as CertaDNS with your email address.
- Step 2: Enter Verification Code — type the 6-digit code your app now shows and click Verify & Enable. Finish within 10 minutes of clicking Enable 2FA.
- Save Your Backup Codes appears. Click Show backup codes to see them, and Download backup codes to save them as a text file. Store them away from your phone.
- Click I've saved my codes. The section now reads Two-Factor Authentication is Active.
Sign in with 2FA
- Enter your email and password and click Sign In.
- The page changes to Two-Factor Authentication. Enter the 6-digit code from your app and click Verify 2FA Code.
Sign in with a backup code
- After your password, on the Two-Factor Authentication page, click Lost your phone? Use a backup code.
- Enter one of your 8-character backup codes and click Verify 2FA Code. Upper or lower case both work.
- That code is now used up. Cross it off your list.
To go back to the authenticator field, click Use your authenticator app instead.
See how many backup codes are left, or get new ones
With 2FA on, the section shows how many of your ten codes are left, and warns when three or fewer remain. Click New backup codes, enter your password and click Create new codes: ten new codes are shown to save, and every old code stops working. Your authenticator is unchanged.
Move to a new phone
Turn 2FA off, then on again. Turning it on issues a new secret and ten new backup codes; the old secret and every old code stop working.
- Sign in (with your authenticator, or a backup code if the phone is gone).
- Turn 2FA off, as below.
- Turn it on again, scanning the new QR code on your new device, and save the new backup codes.
Turn off 2FA
- Click Disable 2FA.
- In Disable Two-Factor Authentication?, enter your account password under Confirm your password — not an authenticator code.
- Click Disable 2FA. Your backup codes are deleted with it, and sign-in asks for your password only.
7. Inputs and Settings
| Field | Rules |
|---|---|
| Authenticator code | 6 digits. A new one every 30 seconds. |
| Backup code | 8 characters, 0–9 and A–F, either case. Spaces and hyphens are ignored. Each code works once. |
| Password (to turn 2FA off) | Your current account password. |
8. Outputs and Results
- Settings > Security shows an Enabled badge and Two-Factor Authentication is Active while 2FA is on.
- The backup-codes download is a text file with a header, the date it was generated, and the ten codes numbered 1 to 10.
- Recent Login Activity, lower on the same tab, lists your last ten sign-in attempts with date, IP address, location and Success or Failed. A wrong 2FA code shows as Failed.
9. How to Interpret Results
Normal
- Every sign-in asks for a code after your password, on every browser and device.
- Resetting a forgotten password does not turn 2FA off; you still need a code afterwards.
Worth investigating
- Failed sign-ins you did not make, especially failed 2FA attempts — someone may have your password. Reset it.
10. Common Issues and Explanations
"Invalid verification code" while setting up
The code had changed, or your device's clock is off. Turn on automatic date and time on the device and enter the code currently showing.
"Invalid or expired setup token"
More than 10 minutes passed since you clicked Enable 2FA. Click Cancel Setup, then start again with a fresh QR code. Remove the unused entry from your authenticator app.
"Invalid 2FA code. Please try again."
For an authenticator code: check the device clock and use the code currently showing. For a backup code: it may already have been used, or you may be in the 6-digit field — click Lost your phone? Use a backup code first.
"Too many failed attempts. Please wait … seconds before trying again."
After 5 wrong codes in 15 minutes, sign-in pauses for 60 seconds; after 10, for 10 minutes. The count applies to your account and to your network address, and a successful sign-in clears it.
"Invalid password" when turning 2FA off
Turning 2FA off asks for your account password, not a code. If you have forgotten it, use Forgot Password? first.
I have lost my phone
Sign in with a backup code, then turn 2FA off and on again to set up your new device and get new codes.
I have lost my phone and my backup codes
You cannot complete sign-in yourself. Contact support; support can remove 2FA from your account so you can sign in with your password and set it up again.
11. Limits and Constraints
| Constraint | Value |
|---|---|
| Authenticators per account | 1 |
| Backup codes | 10, each usable once |
| Time to finish setup | 10 minutes |
| Code tolerance | 30 seconds either side |
| Wrong codes before a pause | 5 (60-second pause); 10 (10-minute pause) |
- The dashboard does not show how many backup codes you have left. Keep your own list.
- There is no separate button to regenerate backup codes; turn 2FA off and on again.
- API keys do not ask for a 2FA code.
12. Related Features
- Account & Subscription Management — signing in, password reset and login activity.
- API Keys — access for scripts and routers without your password or a 2FA code.
13. Updates and Behavior Changes
- 30 September 2026. Backup codes now work at sign-in: click Lost your phone? Use a backup code after your password. Before this date the sign-in page accepted only 6-digit authenticator codes, and anyone without their authenticator needed support to get back in. Earlier versions of this article also described a Regenerate Backup Codes button, and said turning 2FA off needed a code; neither was the case.
- 1 October 2026. The 2FA section shows how many backup codes are left, and New backup codes (with your password) replaces them without turning 2FA off.
- 30 September 2026. The backup-codes download is named
certadns-2fa-backup-codes.txt.