DNSFilter 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
DNSFilter is a DNS-based web filtering and threat protection service, and your DNSFilter account is the one you use to sign in to its dashboard, where you manage policies, sites, Roaming Clients and users. Multi-factor authentication (MFA) there is no longer really optional. Since July 1, 2025, every new DNSFilter account has it enforced, and new accounts can choose between an email code and a code from an authenticator app (DNSFilter). Older accounts can turn it on themselves, and admins can require it for everyone in an organization.
DNSFilter says any app that makes time-based one-time passwords (TOTP) works. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the DNSFilter steps come from DNSFilter's own help center, linked below, which we read on October 21, 2026. The help center blocks automated requests, so we read its articles in archived copies on web.archive.org and checked them against the help center's own public article feed for the latest versions. We haven't tested them on a DNSFilter account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Which accounts need it
DNSFilter's pages don't fully agree here. The MFA article says enforcement applies to accounts created on or after July 1, 2025 (DNSFilter). The FAQ, updated in October 2026, says MFA has been required for all DNSFilter accounts since that date (DNSFilter). If your account is older and you aren't asked for a code, you can still turn it on from your account settings.
Turn on 2FA with an authenticator app
DNSFilter's Account Settings article, from June 2026, puts the setting on the Security tab (DNSFilter, DNSFilter):
- In the DNSFilter dashboard, select Account at the bottom of the left navigation panel. (The older MFA article says to select your Account icon, then Account Settings.)
- Open the Security tab and select Enable Multi-Factor Authentication.
- Select Set up using an app.
- DNSFilter's help then just says to follow the instructions in the dashboard. If a QR code appears, open Novaz, tap +, then Scan QR code, and point the camera at it. If the dashboard is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you're shown a key rather than a QR code, tap +, then Enter key manually in Novaz, and type it as the Setup key. See What is a 2FA setup key?
- Enter the code from Novaz when the dashboard asks for it.
On a new account, you set up MFA during the first sign-in with email. You can then switch to an app from your account security settings using the same steps.
Requiring it for your organization
Users with Admin permissions or higher can require MFA for everyone. Go to Organization (or MSP), then Settings, and turn on Require two-factor authentication. Each user is asked to set it up the next time they sign in, and their Multi-Factor Auth status shows Pending until they do (DNSFilter).
Set up MFA on your own account first. DNSFilter warns that turning on the switch without it signs you out at once and asks you to set it up before you can get back in. Accounts started on or after July 1, 2025 don't have this switch at all, because MFA is already enforced for each user (DNSFilter).
If your organization signs in through single sign-on, you sign in with your identity provider instead. DNSFilter's pages don't say whether its own MFA prompt still appears then.
No backup codes in the docs
DNSFilter's help doesn't mention backup or recovery codes. Unless you back up Novaz with iCloud backup or a backup file, that phone holds your only copy of the DNSFilter key. DNSFilter suggests giving the Owner role to a shared company address, such as an IT mailbox, so the account stays reachable if MFA settings change or someone leaves (DNSFilter).
If DNSFilter rejects your code
DNSFilter's help has no advice for rejected codes. Check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Lost your phone or changing phones
How you get back in depends on your role and account (DNSFilter):
- You're a user in an organization that requires MFA: ask an Owner or Admin. They go to Organization (or MSP), then Users, find you, select More Actions, then Reset MFA. You set it up again at your next sign-in.
- You're the account Owner: you can't reset yourself. Submit a request to DNSFilter Support.
- Your account started on or after July 1, 2025: the article says "MFA resets are managed through the TOTP tool, not DNSFilter." It doesn't explain what that means in practice, so if you're locked out, contact Support.
To contact Support, create an account on DNSFilter's help center with the same email address as your DNSFilter account, sign in, and choose Submit a request (DNSFilter). DNSFilter doesn't say what proof it asks for or how long a reset takes.
For a new iPhone, reset or re-enroll while you can still sign in. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new phone instead; without one, you'll add DNSFilter again. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
