This has to be the most ill-advised security feature Cloudflare has implemented to date. Since it’s rollout we have seen:
Extensive delays in helping customers update their DNS records as we need to get them involved and have them forward mails
Experienced accounts with out-of-date email addresses with no access to mailbox anymore (this is really the customer’s problem - but would not have been an issue before)
Catch-22 type situations where a client needed to update DNS in order to fix a mail issue, but could not gain access to the Cloudflare account as they could not receive the auth mail!!
Haven’t you been getting lots of negative feedback here? Didn’t anybody at Cloudflare think that it might be ill-advised to rely on mail authentication as an access requirement when your system is integral to mail functionality in the first place ???
PLEASE CONSIDER ROLLING THIS BACK! If users want more security they will turn on 2FA! If you feel user’s are not adopting 2FA widely enough: Nudge them to do so!
Don’t just put up a wall to login with wide-reaching consequences like this … sadface