Academy › Publishing › Domain and email
The app, not SMS, for two-factor authentication
Your two-factor lock stops depending on your phone carrier and depends instead on an app that only you have.
By Yodai · Published on September 6, 2026 · Updated on October 12, 2026
The second step is the lock that's supposed to keep people out even if they have your password. You turn on two-factor authentication in your domain registrar's panel, and it gives you two buttons. One says get the code by text message. The other, use an authenticator app. They look like the same lock with two different keys. They're not.
A password you don't reuse anywhere else and a recovery email that doesn't live inside your own domain are the first two locks. The second step comes next, and here too, one option is genuinely the better choice while the other just looks like it from the outside.
Your phone isn't as much yours as you think
Text messages feel reliable because they land on the device in your pocket. But that message doesn't go straight from the registrar to your hand: it crosses a phone carrier's network, and that network can be rerouted.
Someone who gathers your personal information, like your name, Social Security number, or address, can pose as you with your cell phone carrier and request a duplicate SIM card. This scam is called SIM swapping, and whoever pulls it off doesn't need your password. All they need is for the carrier to believe them.
And the moment your number switches SIM cards, the text messages with your verification code start arriving on their phone, not yours. You won't even know until you try to log into your own account and can't.
A phone number isn't a secret: it's right there on your business card, and text message codes depend on your carrier not falling for a scam.
That's why an authenticator app moves the problem somewhere safer. The code no longer originates on a network that can be rerouted: it's generated right on your phone, through a calculation only the app and the registrar's server know. There's no carrier in between to convince, and no number to port.
The app, step by step
- 1Install the app
Google Authenticator, Authy, or the password manager you already use, if it generates this type of code. Any of the three works; what matters is having it installed before you open the panel. - 2Go to security settings
In your domain registrar and in your domain's email, separately, find the two-factor authentication section and choose the app option, not text message, even if text message is checked by default. - 3Scan the code
The panel shows a QR code. Open it with the app and point your camera at it: within seconds it starts generating a six-digit number that changes every thirty seconds, with no connection needed. - 4Confirm the sync
The panel asks you to type in the number the app is showing at that moment. It's the only way to check that the two clocks, the phone's and the server's, agree. - 5Save your backup codes
Before you close the screen, many panels give you a list of one-time codes. Save them right now, somewhere other than your phone: it's the step almost everyone skips, and the one people regret the most later.
None of these apps needs signal or an internet connection: the calculation happens locally, so the code keeps showing up even if your phone is in airplane mode or has no SIM card in it. That's the exact opposite of text messages, which stop working the moment there's no network.
When text message still has a place
Some older panels won't let you turn on the app and only offer text message. It still has a place there, just not the one it had when it looked like the normal option.
- Depends on coverage and whichever carrier you're with
- Can be rerouted with a SIM swap without touching your password
- Stops arriving if you're out of the country without roaming or a local SIM
- Still better than having no second step at all
- The code is generated right on the phone, without touching any network
- Works the same in airplane mode or without signal
- Doesn't depend on the number still being yours
Which one I pick: I always choose the app when the panel offers it. I'd only use text messages as a backup alert on a service that doesn't offer anything else, never as the only lock on an account that controls your domain or your email.
The backup code, saved where it belongs
When you turn on the app, many panels give you those one-time codes made for the day you switch phones, lose yours, or it breaks. They're the spare key, and you don't leave a spare key under the same doormat as the door it opens.
With this, the second step for your registrar and your domain's email no longer depends on a phone number you never fully controlled to begin with. Next up is the lock that keeps anyone from taking your domain without your signature, and the email that poses as the registrar without being one.
- Your registrar and your domain's email both ask for the app, not text message.
- The app generates the code right on your phone, without depending on any network.
- The backup codes are saved somewhere other than your phone and somewhere other than the email they protect.
- Text message is only for the panel that doesn't offer anything else, never as the only lock.
Test yourself
Answer before opening each one. If one gives you trouble, go back to the section that explains it.
1. A business partner tells you to turn on text message because it's faster and the password is already enough. What do you tell them?
That a password alone is no longer enough as the only lock, and that text messages open a door neither of you controls: your cell phone carrier's. Turn on the app even if it takes two extra minutes, because that code is generated right on your phone and never travels through any carrier's network.
2. You're about to spend two weeks out of the country, without roaming, and you're worried about getting locked out of your accounts. Do you switch to text message before you leave?
No, it's the other way around: SMS is what fails without signal, while the app generates the code the same way in airplane mode. What you carry with you is the list of backup codes, printed out, in case your phone gets lost or breaks while you're out.
3. You find a file called codigos-respaldo-dominio.txt saved inside the same email account that manages the domain, the one you use every day. What's wrong here?
The spare key lives in the same house it protects: if that email account goes down, the whole second step goes down with it. Move the file to a password manager, or print it out, keeping it outside of any account that depends on the same lock.
With the app turned on and the backup codes stored outside the account they protect, you've got three locks in place. What's missing is the one that decides whether someone can move the entire domain to another registrar without you signing off on it.
In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.
NextThe lock that stops anyone from taking it without your say-so