# Two Factor Authentication via email broken

**URL:** <https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302>\
**Category:** Community Support\
**Created:** [February 12, 2022, 8:32pm UTC](https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302 "2022-02-12T20:32:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rocketwolfe](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@rocketwolfe](https://forums.rocket.chat/u/rocketwolfe)\
**Post date:** [February 12, 2022, 8:32pm UTC](https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302/1 "2022-02-12T20:32:15Z")

</div>

### Description

So I have been trying to set up smtp via my own mail server (see other thread) and in this course I have “locked myself out” of being able to authenticate via code received by email. (Rocket chat is trying to send the code to an email that can’t be reached. But in order to change that email address back to one that can be reached, I need to enter a code that is being sent to the email address that can’t be reached…)

I included the following two lines in my docker-compose file to deactivate Two Factor Authentication:

- OVERWRITE\_SETTING\_Accounts\_TwoFactorAuthentication\_Enforce\_Password\_Fallback=false
- OVERWRITE\_SETTING\_Accounts\_TwoFactorAuthentication\_Enabled=false

After docker-compose upping, in the admin console the Two Factor Authentication toggle is shown as not enabled, but when I try to change a setting (particularly my email address), the system still tries to send out a code for Two Factor Authentication via email - which of course does not actually get sent out.

So how do I actually and effectively disable Two Factor Authentication without the need to Two Factor Authenticate that change?

Thanks

### Server Setup Information

- Version of Rocket.Chat Server: 4.4.2
- Operating System: Debian 11
- Deployment Method: docker-compose
- Number of Running Instances: 1
- DB Replicaset Oplog: enabled
- NodeJS Version: 14.18.2
- MongoDB Version: 4.4.12
- Proxy: haproxy
- Firewalls involved: pfSense

### Any additional Information

Can’t think of anything of relevance.

---

<div class="post-metadata">

**Author:** ![debdut.chakraborty](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/debdut.chakraborty/32/2900_2.png) [@debdut.chakraborty](https://forums.rocket.chat/u/debdut.chakraborty)\
**Post date:** [February 12, 2022, 9:41pm UTC](https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302/2 "2022-02-12T21:41:39Z")

</div>

This is interesting … I’ll have to check. Thanks for letting us know.

cc @duda.nogueira in case this slips me, iirc these are the only settings that control 2fa. Either I’m forgetting something, or setting handling recently changed (not to my knowledge).

---

<div class="post-metadata">

**Author:** ![rocketwolfe](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@rocketwolfe](https://forums.rocket.chat/u/rocketwolfe)\
**Post date:** [February 13, 2022, 4:15pm UTC](https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302/3 "2022-02-13T16:15:27Z")

</div>

Tried again. Still sends out email code although the Two Factor toggle is on disabled.

If it is not possible to effectively overwrite the setting, would it be possible to overwrite the unreachable email address somewhere?

---

<div class="post-metadata">

**Author:** ![dudanogueira](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/dudanogueira/32/2529_2.png) [@dudanogueira](https://forums.rocket.chat/u/dudanogueira)\
**Post date:** [March 3, 2022, 11:29am UTC](https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302/4 "2022-03-03T11:29:35Z")

</div>

Hi!

I could not reproduce this on 4.5.0, tweaking with those settings you mentioned

Are you able to consistently reproduce this?

I was also investigating another 2FA email issues.

---

<div class="post-metadata">

**Author:** ![rocketwolfe](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@rocketwolfe](https://forums.rocket.chat/u/rocketwolfe)\
**Post date:** [March 4, 2022, 7:17pm UTC](https://forums.rocket.chat/t/two-factor-authentication-via-email-broken/13302/5 "2022-03-04T19:17:42Z")

</div>

Updated to 4.5.0 and issue is gone.

Thanks for the suggestion.