MoovMail logo|Documentation
Get Started

Getting Started

  • Introduction
  • Quick Start Guide
  • Plans & Pricing

Mail (End User)

  • Inbox & Folders
  • Mail Deletion Policy
  • Compose & Send
  • IMAP & Outlook Setup
  • Sending Email

Settings

  • Settings Overview
  • Security & 2FA
  • Authentication Policy
  • App Passwords

Storage & Productivity

  • File Storage
  • Calendar & Meetings
  • MoovChat
  • Contacts & Directory

Administration

  • Admin Panel Overview
  • Admin Authentication Policy
  • Recoverable Items
  • User Suspension & Offboarding
  • User Management
  • Domain & DNS
  • Adding Team Members

DNS Configuration

  • DNS Overview
  • MX Records
  • SPF Configuration
  • DKIM Setup
  • DMARC Policy
  • Verify DNS Records

Migration & Security

  • Email Migration
  • Security Overview

Troubleshooting

  • Common Issues
  • DNS Problems

Authentication policy (2FA / OTP)

Users enroll security methods. Organization admins set policy. Platform SMS credentials stay on the server.

How Google-style settings map to MoovMail

LayerWhereWhat you do
UserSettings → SecurityTurn on an authenticator app, set recovery email and phone. You must scan the QR or verify the phone yourself.
Org adminAdmin → General → Authentication policyOptional vs required 2FA, grace period, apply to all users or admins only, allow authenticator / email OTP / SMS OTP, unusual-sign-in defaults.
PlatformServer environmentSMS gateway API key and sender template. Never shown in Admin and never stored in public docs.

Admins cannot enable authenticator 2FA fora user without that user's phone. They can require enrollment, reset 2FA from User Management, and choose allowed methods.

What you can use today

  • Authenticator-app 2FA (TOTP) — Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and similar apps. Setup guide: Security & 2FA.
  • Required 2FA — after the grace period, password login will not issue a mailbox session until the user enrolls an authenticator. SSO still uses the company IdP (MoovMail 2FA is not a second SSO step).
  • Backup codes— ten one-time codes shown when 2FA is turned on. Admins reset 2FA from User Management; they cannot scan the user's QR for them.
  • Unusual-sign-in OTP — email code, or SMS after the user verifies a mobile number and the platform SMS key is set.
  • Step-up — password change, recovery contact change, and mailbox export require an authenticator or backup code when 2FA is on.

Unusual sign-in OTP

  • Email OTP for a new IP or too many IPs in 24 hours, when authenticator 2FA is off.
  • SMS OTP after the user verifies their mobile number, if the platform SMS key is set.
  • Trust this browser for 30 days skips the unusual-sign-in code on that device.
  • First login after an invite is not treated as unusual.

Login order

  1. Email and password (or SSO).
  2. If authenticator is on → enter the app code or a backup code.
  3. Else if required 2FA grace has ended → enroll an authenticator.
  4. Else if the sign-in looks unusual and the org allows OTP → email code, then SMS if the phone is verified.

SSO still uses your company identity provider. MoovMail authenticator is not a second step on SSO login.

Admin defaults

New organizations start with 2FA optional, authenticator / email OTP / SMS OTP allowed, and unusual-sign-in OTP on. Admins change this under Admin → General → Authentication policy. See the admin authentication policy guide.

User 2FA setup → · Security overview → · Admin policy →