Two‑factor authentication (2FA) creates an additional verification step after a user signs in with their username and password. When enabled, it helps protect your Dotdigital account by ensuring only authorised users can access it.
There are two ways to enable 2FA on your Dotdigital account:
TOTP (Time-based one-time password)
This is the most secure option, and selected by default. The user must scan a QR code with the authenticator app on their mobile device to set this up, and then enter the password generated for them when they log in.SMS
We send a verification SMS message on login to the mobile number stored against the user account in Dotdigital.
Before you start
Things you need to know:
You must be the account owner to set up two-factor authentication for an account.
You can’t use two-factor authentication if you have single sign-on (SSO) enabled for your account.
Learn how to set up Single Sign-On (SSO) for your account.Users who require access to an account with TOTP-type 2FA enabled must have downloaded an authenticator app to their mobile device, for example Microsoft Authenticator or Google Authenticator, to their mobile device.
Two-factor authentication overview
Once two‑factor authentication is enabled, you’re asked to verify your login in the following situations:
When you log in from a new device or a browser.
When you sign in from a device or browser where cookies have been cleared since your last login.
If it’s been more than 30 days since your last login.
We use a cookie to recognise devices and browsers you’ve used before. The cookie expires after 30 days and is reset each time you sign in successfully.
After you enter your username and password, the verification step depends on the 2FA method enabled on your account:
You receive a unique one-time authentication passcode. You must then enter the passcode to verify your identity.
You are prompted to scan a QR code with the authenticator app on your mobile device to generate a one-time password which you enter to verify your identity.
On subsequent logins, you only need to enter the code generated by your app.
Set up two-factor authentication
Expand the User menu and select Settings.
Go to General > Account settings.
Under the heading Security, select the Two-factor authentication checkbox.
Expand the drop-down menu and choose from:
SMS
Some additional setup is needed. Go to the section SMS authentication.TOTP
Select SAVE SETTINGS.
SMS authentication
When you enable SMS‑based two‑factor authentication, you’re prompted to add a mobile number for any account users who don’t already have one saved on their profile.
Two‑factor authentication is enabled at account level, so all users must be able to receive SMS verification messages.
If all users already have a mobile number saved, you instead see the Authentication mobile number field, where you can confirm or update your own number.
Select [Add mobile number] and enter a mobile number for a user.
Select SAVE.
You can optionally select Send an SMS test to send a test message to your own mobile number once you have entered it.Once you have added mobile numbers for all requested users, select CONTINUE.
Select SAVE SETTINGS.
Add or edit a mobile number on your user profile
If SMS‑based two‑factor authentication is enabled on your account, you must have a valid mobile number saved on your user profile so you can verify your login when required.
User mobile numbers
After SMS-based two-factor authentication has been set up on an account, the account owner can’t edit or add mobile numbers for other account users.
Each user is responsible for managing their own mobile number in their user profile.
If a user removes or fails to update their mobile number and therefore cannot access the account, they must contact the support team to restore their access.
To add or edit a mobile number for your user profile:
Expand the User menu and select Your profile.
Select the edit icon.
Enter the mobile number that you want us to send your passcodes to.
Select SAVE.
Turn off two-factor authentication
To ensure the security of your account, if you want to turn off two-factor authentication, you must contact the support team.
Log in using two-factor authentication
If you meet the criteria for a two-factor authentication challenge, then the login process looks like this:
Go to the login page.
Enter your email address and password, then select LOG IN.
Verify your login:
SMS-based 2FA
We send an authentication passcode to your registered mobile phone number. In the Verification code box, enter your unique authentication passcode, then select VERIFY LOGIN.
TOTP-based 2FA
If it’s the first time you have logged in using TOTP-based authentication, you see a verification screen with a QR code and a request for a six-digit one-time password. Open the authenticator app on your mobile device and scan the QR code. Once your app has provided it, enter the password on the verification screen, and select VALIDATE.
On subsequent log-in attempts requiring you to verify, you just need to enter the password generated in your authenticator app.
Provided the verification code you have entered is correct, you are logged in to Dotdigital.
Troubleshoot
Not receiving the verification SMS
If you don't receive your verification SMS, try restarting your device. This can prompt the message to be delivered to you. If that doesn't work, you can contact our Support team for further help.
Reset two-factor authentication for a user
It may be that a user needs to reset their 2FA. This can be done by editing the user profile.
Expand the User menu and go to Settings > Users and teams > Users.
Select the user you want to reset 2FA for.
For Authentication method, select RESET.
Select SAVE.
Once 2FA has been reset the user must re-verify on their next log in by scanning the QR code generated by Dotdigital.