OTP pin via email works with one tld but not another

[retroman]

Related to

Access

What is the issue you’re encountering

OTP pin via email works with one tld but not another

What steps have you taken to resolve the issue?

let’s call our company, example.

we have a mail server that receives emails for both @example.com and @example.email.

one is the alias of another, so emails sent to [email protected] and [email protected] are sent to the same inbox.

the @example.email alias is newer but it has been active for over a year and receives emails just fine.

i have configured both domains in zero trust, per attached. users logging in with their @example.com address receive their pin via email.

others using @exmaple.email receive no emails from cloudflare.

again, it’s the same mail server. i have scoured all logs, quarantines, activities and see so email arriving addressed to @example.email.

could it be that zero trust doesn’t like the .email tld for emailing?

Screenshot of the error

[syda]

Hi there,

There should be no issue with the TLD. Have you added example.email to your Cloudflare account and the same MX records as example.com?

[retroman]

thanks, figured it shouldn’t be a problem but still is.

yes, 1 mx record for both .email and .com domains, exact same mail server and priority.

all external and internal emails sent to users at either domain arrive just fine.

here’s something that might explain this, though improbable. at one time example.email was using cloudflare’s email routing. then we pulled the associated mx records from the dns config screen and replaced them with our 1 mx record. the entry is still in email routing, though disabled, per attached image.

wonder if internally cloudflare sees this crippled email routing entry and fails to deliver any emails to the associated domain.

strangely there’s no facility for us to remove this from email routing and reset it to a fresh state to see if that fixes this issue.

any ideas?

[retroman]

finally got this resolved. it was caused by an overlooked legacy access policy.

link to my other post regarding this:

Deleting email routing

Email routing is fully disabled so this would not have any impact. It’s most likely an issue with access policy: If the email is allowed by an Access policy, you will receive a PIN in your inbox. Note: By design, blocked users will not receive an email. The login page will always say A code has been emailed to you, regardless of whether or not an email was sent.