IBM NS1 Connect 2FA: how to set up an authenticator app

NS1 is now IBM NS1 Connect, IBM's managed authoritative DNS service, and the old ns1.com help article on 2FA now forwards to IBM's product page (IBM). Whoever gets into your NS1 Connect login can change where your domains point, so two-factor authentication (2FA) matters more here than on most accounts. NS1 Connect's own 2FA uses one method only: a time-based code from an authenticator app (TOTP) (NS1 Connect). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the NS1 Connect steps come from IBM's own NS1 Connect documentation, linked below, which we read on October 24, 2026. We haven't tested them on an NS1 Connect account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First, check how you sign in

NS1 Connect now has three kinds of login, and the 2FA steps in this guide apply to only one of them:

• Username and password: NS1 Connect's own 2FA applies. Read on.
• IBMid: since June 2026, every new NS1 Connect account must sign in with an IBMid, and so must every user added to it. Their multi-factor settings live in the IBMid, managed through My IBM, not in NS1 Connect (NS1 Connect).
• Your company's single sign-on (SSO): NS1 Connect's 2FA doesn't apply. Your identity provider handles it (NS1 Connect).

Is 2FA required?

That's up to your organization. A user with the Manage global 2fa permission can switch on Enforce two-factor authentication for all users under Security settings, on the Account login tab. Each user then has to set up an authenticator app the next time they log in (NS1 Connect). The permissions list spells it Manage global 2FA (NS1 Connect). If your organization doesn't enforce it, you can still turn it on for your own login.

Turn on 2FA with an authenticator app

IBM's steps (NS1 Connect):

1. In NS1 Connect, click the User Settings icon and select Your profile.
2. Turn on the Enable two-factor authentication switch. NS1 Connect shows a QR code and a TOTP key.
3. In Novaz, tap +, then Scan QR code, and point the camera at the code. If NS1 Connect is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. If you'd rather type it, the text version is the TOTP key. In Novaz, tap +, then Enter key manually, and fill in Service, Account if you like, and the key as the Setup key. See What is a 2FA setup key?
5. Back in NS1 Connect, enter the six-digit code from Novaz and click Verify authentication.

IBM's page says the codes have six digits but doesn't say how often they change or how long the key is. Scanning the QR code is the safer choice, because it passes those settings to your app. A key typed by hand gets 30-second codes.

When NS1 Connect asks for a code

Every time you log in with your username and password, once 2FA is on, either for you or for the whole organization (NS1 Connect). IBM's pages don't mention a way to remember a trusted device.

No backup codes

IBM's NS1 Connect pages don't mention backup or recovery codes, and they don't describe a second method. The only documented way back in is an administrator reset (below). Without a Novaz iCloud backup or backup file, your key exists only on your iPhone. So make sure someone else in your organization has the Manage global 2fa permission before you rely on it, especially if you're the only admin.

If NS1 Connect rejects your code

IBM's pages don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

If you lose your authenticator or change phones

Ask an administrator in your NS1 Connect account to reset your 2FA. They need the Manage global 2fa permission. They click the User Settings icon, choose Users & teams, open the Users tab, and pick Disable 2FA from the Options menu beside your name (NS1 Connect).

You can then log in with just your username and password, and NS1 Connect asks you to set up 2FA again. Do it on the spot: IBM warns that skipping this step locks you out at your next login (NS1 Connect).

A new iPhone works the same way, unless you restore your accounts from a Novaz iCloud backup or backup file. Without one, have an admin reset your 2FA, then scan the new QR code on the new phone. See How to transfer your authenticator app to a new iPhone.

If nobody in the account can reset you, IBM's pages don't describe a recovery process. They only say that customers on the Premium or another paid plan get support through IBM, and that the primary account administrator opens cases at ibm.com/mysupport (NS1 Connect). More in Lost the phone with your authenticator app?

IBM doesn't document a way to switch off your own 2FA.

Official NS1 Connect help

• Managing two-factor authentication
• Enabling two-factor authentication (2FA)
• Enforcing two-factor authentication for all users
• Resetting two-factor authentication for a user
• Account permissions
• Release notes