Two-Factor Authentication for Business Email: Every Mailbox Needs It

Your email account resets the password on everything else you own: your bank, your domain registrar, your accounting software, your customer database. A leaked email password is therefore a leaked everything. Two-factor authentication is the one control that makes a stolen password insufficient on its own, and it costs nothing but a few minutes per person. Here is what it protects against, which type to choose, and how to roll it out to a small team without locking anyone out.

Quick answer

Two-factor authentication (2FA, also called MFA) requires something you know (the password) plus something you have (a phone app code, a hardware key, or at minimum an SMS code) to sign in. Use an authenticator app or a hardware security key for everyone; keep SMS only as a fallback. Turn it on for every mailbox, starting with the owner, finance, and any address used for password resets elsewhere.

What 2FA does and does not stop

• Stops: reuse of a password leaked from another site, brute-force guessing, and most credential phishing where the attacker only captures the password.
• Stops: a former employee or contractor who still remembers a shared password.
• Does not stop: real-time phishing pages that ask for the code too and relay it within seconds. Hardware keys and passkeys resist this; app codes and SMS do not.
• Does not stop: malware on the device you are already signed in on, or a session cookie stolen from that device.

Choosing the second factor

1. Hardware security key (FIDO2 / WebAuthn) or a passkey stored on your phone. Strongest option, phishing-resistant, and increasingly supported by mail providers. Buy two per person and register both.
2. Authenticator app generating time-based codes (TOTP). Works offline, free, widely supported. The app must be backed up or the person will be locked out when they change phones.
3. Push approval in a provider's own app. Convenient, but train people to deny any prompt they did not trigger; attackers send repeated prompts hoping someone taps approve.
4. SMS codes. Better than nothing, but vulnerable to SIM-swap fraud and to number changes when someone leaves. Use as a recovery method only.

Rolling it out to a small team

1. Start with the accounts that matter most: the owner, whoever pays invoices, whoever manages DNS and the domain registrar, and any admin account at your mail provider.
2. Pick one method as the standard so support is simple. For most small teams that is an authenticator app, with hardware keys for finance and admin roles.
3. Sit with each person for ten minutes. Enrol the factor, then immediately sign out and sign back in to prove it works.
4. Save the backup codes the provider generates. Store them in the company password manager, not in the mailbox they protect.
5. Set a date after which sign-in without 2FA is not allowed, and check every mailbox on that date.

Mail apps, IMAP, and 2FA

Desktop and mobile mail apps connect over IMAP and SMTP with a username and password, and most cannot prompt for a second factor. Providers handle this differently: some issue app-specific passwords, some accept the main password once 2FA has been satisfied through a browser, some use OAuth. Check your provider's documentation for the exact method. Whatever it is, treat any app password as a real credential: give one per device, name it after the device, and revoke it when that device is lost or replaced. With OquMail you connect any mail app over IMAP on port 993 (SSL/TLS) and SMTP on port 587 (STARTTLS); consult the current OquMail documentation for how sign-in protection applies to those connections.

Recovery planning so 2FA does not lock you out

• Two registered factors per person, for example a phone app plus a hardware key, or a key plus printed backup codes.
• A documented recovery path for the owner account that does not depend on one phone. The business should be able to survive a lost handset.
• A named second admin at the mail provider and the domain registrar, so one person's lockout is not the company's lockout.
• An offboarding step that removes the leaver's phone as a factor on any shared or admin account.

Mistakes to avoid

• Enabling 2FA on the founder's account only. Attackers go for the bookkeeper.
• Registering one phone number as the factor for several people's accounts.
• Storing backup codes in a note inside the same mailbox.
• Approving push notifications reflexively. If you did not just try to sign in, the answer is deny, then change the password.

Common questions

Is 2FA worth it for a two-person business?

Yes, arguably more so. In a two-person business one mailbox usually holds the registrar login, the bank, and the client list. There is no IT department to notice a takeover early.

What happens when someone gets a new phone?

If they used a cloud-backed authenticator app or a hardware key, nothing. If they used an app without backup, they sign in with a backup code, remove the old factor, and enrol the new phone. Make "moved phone?" a standing question in your monthly check.

Does 2FA replace a strong password?

No. The password is still the first factor and still the thing that a real-time phishing page captures. Use both: a long unique password from a manager, and a phishing-resistant second factor where you can.