Resolved: Authentication token emails not being sent

After logging in from a fresh IP address, I was prompted to enter an authentication token being sent to me via email. The problem is, the emails weren’t being sent. I tried it three times, waited 24 hours, and they never arrived. Other automated Cloudflare emails did arrive during that time so I knew the problem wasn’t my email address. After lashing out at support and wasting the day I discovered that I was in the wrong. I had been receiving the emails containing the tokens but they had been formatted in a way that made it easy to skim over and dismiss them. I’m posting this information here in case others make the same mistake.

As of July 31 2018, the email containing the token has the subject line “Please confirm attempted account access”.

Here was my confusion. Both the “Please confirm attempted account access” and “Your Cloudflare account has been accessed from a new IP Address” emails contain roughly the same information. The fact that they both show

Time: 2018-07-30 22:36:36 UTC
IP Address:
Browser: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/ Safari/537.4

in the first few lines makes it very easy to dismiss them as being the same type of email. It’s even harder because the token itself is somewhat hidden in the middle of the email body with no formatting to make it stand out.

That is all. Hope this helps someone.

1 Like

Thanks for sharing. I’ll take this to the team that manages the eMFA and see if there are any ways to change the token emails to make them easier to distinguish. Hopefully you got formal 2FA setup so that you don’t have to worry about token emails anymore :wink:

I have received THREE emails with a token for an account I accessed after deleting my browser cookies. ALL THREE result in an error that says my token is incorrect. So what’s Plan B???