Two-factor authentication (2FA) protects your Domain India account with a second step at sign-in: after your password, you enter a six-digit code from an authenticator app on your phone. Your client area controls your domains, hosting, invoices and tickets, so it is worth protecting. This guide explains why 2FA matters, how it works and how to turn it on.
2FA is optional and recommended. Turn it on under Account › Security (/client/security/2fa): confirm your password, scan the QR code with an authenticator app, save the ten recovery codes and enter the app's six-digit code. Each sign-in then asks for a code, unless you tick Remember this device for 30 days on your own computer. Lost your phone with no other device? Open a ticket.
The complete walkthrough, with every screen and error message, is in How to enable two-factor authentication.
1. Why turn on 2FA
Whoever signs in to your client area can change your domain's nameservers, reset your control panel password and read your billing details. Passwords leak through phishing emails, reused passwords and infected computers. With 2FA, a stolen password on its own is not enough to get in.
2. How the codes work
When you scan the QR code, your authenticator app and your account share a secret. The app combines that secret with the current time to make a new six-digit code every 30 seconds. That is why:
- no SMS is needed, and the phone works offline;
- the phone's clock must be right; set it to automatic date and time;
- each code only works for a short time, so type it as soon as it appears.
3. Turn it on
- Open Account › Securityin the client area and click Enable 2FA.
- Confirm your current password.
- Scan the QR codewith an authenticator app such as Google Authenticator, Authy or Microsoft Authenticator. Password managers with authenticator support also work. If scanning fails, type the Secret Key shown under the code.
- Save your recovery codeswith Download Codes or Copy All Codes.
- Enter the six-digit codefrom the app and click Verify Code. You are signed out; sign in again with a code.
4. Recovery codes
Setup shows ten one-time recovery codes. Store them away from your phone, in a password manager or on paper, and never send them by email, chat or in a ticket. If you think they have been seen, click Generate New Codes on the Security page and enter a code from your app; all the old codes stop working.
5. Signing in with 2FA
Enter your email and password, then the Authentication Code from your app, and click Verify Code. Ticking Remember this device for 30 days skips the code on that browser for 30 days; use it only on a device nobody else uses. Repeated wrong codes count as failed sign-ins, and too many lock the account for 15 minutes.
6. New phone or lost phone
| Situation | What to do |
|---|---|
| Changing phones, old phone still works | On the Security page click Disable 2FA, enter a code from the old phone, then enable 2FA again with the new phone |
| Another device still has the app | Sign in with it, then disable and re-enable 2FA with your new phone |
| No working authenticator app | Open a ticket at /support/ticket from your account email and say you have lost access to your authenticator app |
Support will tell you what is needed to confirm the account is yours. Never put your password or recovery codes in the ticket.
7. Protect the other logins too
Client-area 2FA protects your Domain India account only. Your control panel and your mailboxes have their own passwords. Where available on your server, cPanel has its own Two-Factor Authentication page under Security. Turn on 2FA for the email account you use to sign in to Domain India as well, because whoever controls that inbox can reset your password.
Frequently asked questions
Is two-factor authentication required on Domain India?
No, it is optional, but we recommend it for anyone who manages a business domain or website. It stops someone who has your password from signing in without your phone.
How often does the 2FA code change?
Authenticator apps show a new six-digit code every 30 seconds. If a code is rejected, wait for the next one and set your phone to automatic date and time.
How many recovery codes do I get?
Ten one-time codes during setup. You can replace them at any time with Generate New Codes on the Security page, which makes all the old codes stop working.
I am changing my phone. What should I do?
While you still have the old phone, open the Security page, click Disable 2FA and enter a code from the old phone. Then enable 2FA again and scan the new QR code with the new phone.
What if I lose my phone and cannot sign in?
If another device has your authenticator app, use it. Otherwise open a ticket at domainindia.com/support/ticket from your account email and say you have lost access to your authenticator app. Support will tell you what is needed.
Ready to protect your account? Open Account › Security and click Enable 2FA. Questions? Open a ticket; live chat runs 24/7, tickets get a first response within 15 minutes, and there is no phone support.
Two minutes with an authenticator app keeps your domains and hosting safe even if your password leaks.
Turn on 2FA