2FA via Email
Receive verification codes via email with automatic security notifications
Overview
The auth_totp_mail module extends 2FA with ability to receive TOTP codes via email instead of authenticator app, suitable for users without smartphones.
Automatically sends security notifications for important activities like enabling/disabling 2FA, login from new device.
Key Features
Key points
• TOTP codes via email - Receive 6-digit codes via email, valid for 1 hour
• Security notifications - Auto-email when enabling/disabling 2FA, new device login
• Invite to enable 2FA - Admins can send email invitations to enable 2FA
• Enforce 2FA - Configure mandatory 2FA system-wide or per user group
• Email rate limiting - Max 5 emails/hour to prevent spam
• Login details - Email includes device info, IP, location
Login with 2FA Email
Steps
1. Enter username and password
2. System sends email with 6-digit code
3. Check email (inbox or spam)
4. Enter code in login form
5. Optional: Check "Remember this device"
6. Login successful
TOTP Code Email
| Fields | Trường dữ liệu | Description |
|---|---|---|
| Subject | Your verification code | Email subject |
| Code | 123456 | 6-digit code |
| Valid for | 1 hour | Validity period |
| Device | Windows | Operating system |
| Browser | Chrome | Browser |
| Location | Hanoi, Vietnam | Location |
| IP | 192.168.1.1 | IP address |
Automatic Security Notifications
Notification Types
| Event | Email Subject | Content |
|---|---|---|
| Enable 2FA | Security Update: 2FA Activated | Notification that 2FA has been enabled |
| Disable 2FA | Security Update: 2FA Deactivated | Notification that 2FA has been disabled |
| New device login | New Connection to your Account | Device details, IP, login time |
| Remove trusted device | Security Update: Device Removed | Name of removed device |
Invite Users to Enable 2FA (Admin)
Steps
1. Go to Settings → Users & Companies → Users
2. Select user(s) without 2FA
3. Action → Invite to use Two-Factor Authentication
4. Invitation email sent automatically
5. User receives email with 2FA setup link
Enforce 2FA System-wide
Steps
1. Go to Settings → General Settings → Security
2. Enable "Enforce two-factor authentication"
3. Choose policy: Employees only or All users
4. Users without 2FA will be required to set up on login
Email Rate Limiting
Key points
• Maximum 5 TOTP code emails in 1 hour
• When exceeded: Error message, must wait 1 hour
• Tips to avoid: Don't spam "Resend code", check spam folder first
App TOTP vs Email TOTP Comparison
Choosing the Right Method
| Criteria | App TOTP | Email TOTP |
|---|---|---|
| Security | High (30s code) | Medium (1h code) |
| Convenience | Fast | Slow (wait for email) |
| Requirements | Smartphone + app | |
| Offline | Works | Does not work |
| Limits | 5 attempts/hour | 5 emails + 5 attempts/hour |
| Recommendation | ✅ Preferred | ⚠️ Fallback |
Troubleshooting
Common Errors
| Error | Cause | Solution |
|---|---|---|
| No email received | Email in spam, wrong address, rate limit exceeded | Check spam, verify email, wait 1 hour |
| Code incorrect | Code expired (>1h), entered old code | Request new code, copy-paste instead of typing |
| Strange notification | Login from new device | If not you: change password immediately |