Search... ⌘ K
Get Started Contact Sales

Multi-Factor Authentication

Last updated

Table of Contents

DNSimple supports multi-factor authentication on every user profile, regardless of the subscription plan on any associated account. For account-level security practices, see Account Security.

Multi-factor authentication (MFA) is a multi-step security measure that helps prevent unwanted access to your user credentials. Once enabled, you are prompted to provide a verification code or use a security key in addition to your user email and password when you log in. Verification codes should be generated by an authenticator app and refresh every 30 seconds.

Enabling multi-factor authentication

DNSimple supports MFA using the following methods as a second verification step:

Make sure to install a one-time password authenticator application if you will use one-time passwords for multi-factor authentication. You will need it to generate a verification code to complete the setup. If you will use a security key, have it ready to complete the security key registration.

When you enable MFA for your user profile, DNSimple logs you out of all currently signed-in devices.

To enable multi-factor authentication with one-time password

  1. Go to your user page by selecting User settings in the account switcher at the top-right corner of the screen. Account switcher menu with an arrow pointing to User settings

  2. In the 2-Step Verification card, click Add next to “Connect an authenticator app that generates verification codes”. 2-Step Verification card with Add next to the authenticator app option

  3. Scan the barcode using a one-time password authenticator app. You can also manually enter the secret code by clicking Can’t scan the barcode? and typing the code into your authenticator. Multi-factor barcode

  4. Using the one-time password authenticator app, generate a verification code.

  5. Enter the 6-digit verification code into the field, and click Verify. If the verification code is correct, you will be redirected to the next step. Otherwise, you will be asked to enter a new verification code.

  6. Copy your recovery code by clicking Copy. Store your recovery code in a safe place, like a password or secret management application. You should also click Download recovery code (PDF) to download a PDF file with the necessary information to recover your account should you lose access to all your multi-factor authentication devices.

    Fill in the form with the last 4 characters of your recovery code, and click Continue to complete the setup of your authenticator app.

    Multi-factor confirm recovery code

To enable multi-factor authentication with a security key

  1. Go to your user page by selecting User settings in the account switcher at the top-right corner of the screen. Account switcher menu with an arrow pointing to User settings

  2. In the 2-Step Verification card, click Add next to “Connect a security key to your user” to connect a new security key to your user profile. 2-Step Verification card with Add next to the security key option

  3. Enter a nickname to help you identify the security key you are registering. Security key nickname with recovery code

  4. Click Continue. You should see a prompt to choose the type of security key you want to activate. The prompt will look different depending on your platform and browser. Select the security key type, and activate it to complete the security key setup process.

  5. Copy your recovery code by clicking Copy. Store your recovery code in a safe place, like a password or secret management application. You should also click Download recovery code (PDF) to download a PDF file with the necessary information to recover your account should you lose access to all your multi-factor authentication devices.

    Fill in the form with the last 4 characters of your recovery code, and click Continue to complete your security key registration.

    Multi-factor confirm recovery code

Note

Some security key types, like Touch ID on a Mac, may be tied to a browser. For example, to use Touch ID on both Chrome and Safari browsers, you may need to register a Touch ID security key in Chrome and also in Safari.

Disabling a multi-factor authentication method

You can remove a one-time password authenticator application or any security keys associated with your user profile. If the method you remove is your only one, removing it turns off multi-factor authentication: the confirmation page offers Disable multi-factor authentication instead, and you confirm with your recovery code.

To disable a one-time password authenticator application

  1. Go to your user page by selecting User settings in the account switcher at the top-right corner of the screen. Account switcher menu with an arrow pointing to User settings

  2. In the 2-Step Verification card, click the … menu at the end of the Authenticator app row, then select Delete. This will take you to the confirmation page. 2-Step Verification card with Delete in the authenticator app's menu

  3. On the confirmation page, use the authenticator app to generate a new verification code, and enter your code. Click Disable Two-Factor authentication to confirm and disable multi-factor authentication via the authenticator application. Delete One-Time Password page with the verification code field

To disable a security key

  1. Go to your user page by selecting User settings in the account switcher at the top-right corner of the screen. Account switcher menu with an arrow pointing to User settings

  2. In the 2-Step Verification card, click the … menu at the end of the security key’s row, then select Delete. This will take you to the confirmation page. 2-Step Verification card with Delete in a security key's menu

  3. On the confirmation page, click Confirm deletion. You will be prompted to activate the same security key to confirm its deletion as an MFA method. Delete a security key page with the Confirm deletion button

Logging in with multi-factor authentication

When multi-factor protection is enabled, you must complete a second verification step each time you log in with your user email and password.

Using a one-time password

  1. Log in to DNSimple with your user email and password.

  2. If the credentials are correct, you will see a 2-Step Verification window. This may look different if you also have a security key enabled.

    If you have a security key enabled, it will be the default authentication method displayed. Click Use one-time password to switch to using a one-time password for the second verification step. Multi-factor authentication

    If you do not have security keys enabled, you will see the following 2-Step Verification window immediately: Multi-factor authentication

  3. Use your one-time password authenticator app to generate a verification code, paste the verification code into the form, and submit it to complete the 2-step login verification process.

Note

The verification code automatically expires every 30 seconds. If the expiration is five seconds or less, wait for the next verification code to limit the possibility of an authentication failure.

Using a security key

  1. Log in to DNSimple with your user email and password.

  2. If the credentials are correct, you will see a 2-Step Verification window. Multi-factor authentication

  3. Click Log in, select the type of security key you will be activating, and activate the security key.

Recovery code

When you enable your first MFA method, a recovery code is created as a safeguard. You will need this recovery code to disable MFA if you cannot generate a one-time password with your authenticator app, activate your registered security key, or disable an MFA method. For example, because you lost the security key or the device where the authenticator was installed. Save this recovery code in a secure, memorable place.

Warning

The recovery code is the fastest way to recover access to your account if you can’t generate a one-time password with an authenticator app or activate a security key for completing the 2-step verification process. Store the recovery code in a secure place. Without it, you will need to contact support and complete a verification process before we can restore access, which takes longer.

Note

To help you keep your recovery code accessible, we periodically ask you to confirm that you still have it. About twice a year, the next time you log in, you’ll be asked to enter the last 4 characters of your recovery code before you can continue using your account. The prompt also lets you copy your recovery code again or download a fresh PDF copy, so take a moment to check where it’s stored each time it appears.

When you enter a valid recovery code, multi-factor protection will immediately be disabled. To keep your account protected, you will need to enable it again by connecting a one-time password authenticator application or security key to your user profile. A new recovery code will be generated.

Warning

All security keys and any one-time password-based MFA methods configured will be removed when you use your recovery code to disable MFA. If you belong to accounts that enforce MFA, you are also removed from them, or, where you are the only account administrator, enforcement is turned off. The page lists the affected accounts before you confirm.

Disabling multi-factor authentication during login using the recovery code

  1. Log in to DNSimple with your user credentials.

  2. On the 2-Step Verification page, click Use recovery code. screenshot: Use recovery code for MFA

  3. Enter the recovery code, and click Log in and disable all multi-factor authentications. Recovery code login form with the Log in and disable all multi-factor authentications button

  4. If the recovery code is correct, MFA protection is immediately disabled for your user.

You can also use your recovery code to disable MFA when you cannot remove a one-time password-based or security key-based MFA method.

Disabling multi-factor authentication to remove a one-time password or security key MFA method

  1. Follow the steps to remove a one-time password-based or security key-based MFA method.

  2. On the one-time password or security key removal confirmation page, click the disable multi-factor authentication link. Delete One-Time Password page with the disable multi-factor authentication link

  3. Fill in the recovery code, and click Reset all multi-factor methods. Disable Multi-factor authentication page with the Recovery code field

  4. If the recovery code is correct, MFA protection is immediately disabled for your user.

Recovery codes can be regenerated. When a recovery code is regenerated, you cannot use any previously-generated recovery codes to disable MFA.

Regenerating a recovery code

  1. Go to your user page by selecting User settings in the account switcher at the top-right corner of the screen. Account switcher menu with an arrow pointing to User settings

  2. In the 2-Step Verification card, click the … menu at the end of the Recovery code row, then select Re-generate. 2-Step Verification card with Re-generate in the recovery code's menu

  3. You will see a new recovery code displayed. Store the new recovery code in a safe place, and click Next to confirm the regeneration of your recovery code. Re-generate your recovery code page showing the new code and the Next button

  4. Fill in the recovery code, and click Re-generate recovery code to complete the recovery code regeneration. Re-generate your recovery code page asking for the new code

Multiple accounts

Multi-factor protection is attached to a user profile, not an account, like your user email and password credentials.

If an account has multiple users, each member must enable MFA separately. If your user profile has access to more than one account, you only need to enable MFA once.

One-time password authenticator applications

DNSimple’s one-time password-based MFA implementation is based on RFC 6238, also known as time-based one-time password (TOTP). Any authenticator application compatible with this specification can be used to generate a DNSimple one-time password.

There are many time-based authenticator apps that generate one-time password verification codes. Here are some we recommend:

Security keys

DNSimple’s security key-based MFA implementation is based on the WebAuthn standard.

DNSimple supports WebAuthn-compatible platform authenticators, such as Touch ID, and cross-platform authenticators, such as YubiKey.

Best practices for multi-factor authentication

To benefit from true MFA, you must keep your one-time password authenticator application or security key, and your primary user credentials separate. For example, if you use your mobile device as your one-time password authenticator, you should not have your primary user credentials on your mobile device.

If you decide to use your mobile device as both your security key or one-time password authenticator and device for accessing DNSimple, you still get the added benefit of a second verification step for login should your credentials be compromised, but you will not benefit from true MFA. It is up to you to decide what level of security is important for you and your accounts.

Troubleshooting multi-factor authentication

Ensuring your phone’s date and time are synchronized

One-time password verification codes are based on time, so the time on your phone has to be in sync with the official time. Otherwise, your authenticator app will generate a mismatched code. If your phone’s time is out of sync, or if you have changed time zones, the best way to fix it is to change the time settings on your phone from “Manual” to “Automatic”.

Using a newly-generated one-time password verification code

Sometimes a one-time password verification code may not be accepted, despite entering it correctly. This usually happens when the original token was close to expiration.

The verification code automatically expires every 30 seconds. Most one-time password authenticator apps display a countdown to expiration.

If the expiration is in five seconds or less, wait for the next verification code to limit the possibility of an authentication failure caused by time differences or connection latency.

For other reasons you might not be able to log in, see Troubleshoot Logging In to DNSimple.

Have more questions?

If you have questions about MFA or need assistance setting it up, contact support, and we will be happy to help. You can also read more about DNSimple Enterprise.