DNSimple 2FA: how to set up an authenticator app

DNSimple is a domain registrar and DNS host, so its account often controls a company's website and email. Before you turn on two-factor authentication, know this: DNSimple gives you a single recovery code, not a list, and its help page says plainly, "We cannot disable multi-factor authentication without this recovery code" (DNSimple). Lose both your phone and that code, and support can't turn it off for you.

DNSimple calls the feature multi-factor authentication (MFA). It's free on every plan and works with an authenticator app, a security key such as a YubiKey or Touch ID, or both. Text-message codes aren't mentioned (DNSimple). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the DNSimple steps come from DNSimple's own help pages, linked below, which we read on October 20, 2026. We haven't tested them on a DNSimple account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is it required?

Usually it's optional, but two cases require it, and skipping it has a cost:

• Teams that enforce it. On Teams plans and higher, an account can require MFA from every member before they join (DNSimple).
• .BANK and .INSURANCE domains. DNSimple requires MFA on accounts that register these (DNSimple, DNSimple).
• Without MFA, passwords expire. You must pick a new password every three months (DNSimple).

MFA belongs to your user, not to an account, so one setup covers every DNSimple account you can open (DNSimple).

Turn on 2FA with an authenticator app

Turning MFA on signs you out everywhere, so expect to sign in again. DNSimple's steps (DNSimple):

1. Open the account switcher at the top right and choose User settings.
2. In the 2-Step Verification card, click Add next to Connect an authenticator app that generates verification codes.
3. DNSimple shows a barcode (a QR code). In Novaz, tap +, then Scan QR code. If the page is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. To type a key instead, click Can't scan the barcode? for the secret code. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. DNSimple's codes are 6 digits and change every 30 seconds, which matches manual entry in Novaz. More in What is a 2FA setup key?
5. Type the 6-digit code from Novaz and click Continue.
6. Click Copy to clipboard and paste the recovery code into a password manager. Click Download recovery code (PDF) for a second copy.
7. Type the last 4 characters of the recovery code and click Continue to finish.

Treat the recovery code as your way back

If you lose your iPhone without a Novaz backup (iCloud backup or a backup file), the recovery code is how you get back in. Store it somewhere other than that phone. About twice a year, DNSimple asks for its last 4 characters at sign-in, which is a good moment to check your saved copy.

If the code might have been exposed, click Re-generate next to it, store the new one, click Next, type it in and click Re-generate recovery code. The old code stops working (DNSimple). See 2FA backup codes.

A security key registered alongside the app gives you a second way in if the phone goes missing.

Signing in

DNSimple asks for a code every time you sign in with your email and password; its pages describe no trusted devices. If you also have a security key, it's the default, so click Use one-time password to type a Novaz code. A password reset doesn't skip the code (DNSimple).

If DNSimple rejects your code

DNSimple gives two tips (DNSimple). First, your phone's clock must be set automatically. On iPhone that's Settings > General > Date & Time > Set Automatically, and Novaz warns you when the clock is 15 seconds or more off. Second, if the code has five seconds or less left, wait for the next one. Other causes are in Authenticator code not working?

Changing phones

DNSimple's help doesn't describe a phone switch, but it says you must keep at least one method active. So register a security key first, then Delete the old authenticator (using a code from the old phone) and Add it with the new one. Without a security key, the fallback is the recovery-code reset below. If you have a Novaz iCloud backup or backup file, you can skip all this and restore your accounts on the new iPhone; without one, you set DNSimple up again either way. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with your email and password, click Use recovery code on the 2-Step Verification page, enter the code, and click Log in and disable all multi-factor authentications. That removes every method, security keys included, so set MFA up again right away and save the new recovery code (DNSimple).

Without the recovery code or another working method, DNSimple says it can't remove MFA for you. More in Lost the phone with your authenticator app?

Turning 2FA off

In the 2-Step Verification card, click Delete next to the authenticator app, enter a code, and click Disable Two-Factor authentication. If you can't remove a method, the confirmation page has a link to disable MFA with your recovery code, ending in Reset all multi-factor methods (DNSimple).

Once no method is left, MFA is off: you're removed at once from any account that enforces it (DNSimple), and the three-month password rule applies again.

Official DNSimple help

• Multi-Factor Authentication
• Enforce Account-Wide Multi-Factor Authentication
• Account Security
• Forgot Password
• .BANK Domains
• .INSURANCE Domains