Secure Your MailerLogic Account with MFA

Protecting your MailerLogic account is important because an account takeover can give an attacker access to your data and the ability to send emails using your authenticated sending domain. This can damage your domain reputation and affect future email delivery.

This article explains how to enable Multi-Factor Authentication (MFA) and follow basic security practices for your MailerLogic account.

Enable Multi-Factor Authentication

MFA adds an extra layer of protection to your account. When enabled, you need both your password and a six-digit code from an authenticator app to sign in.

Step 1: Open your Profile

Go to 'Profile' and Find 'Multi-Factor Authentication (MFA)' under 'Security'.

Step 2: Set Up Your Authenticator App

Turn on 'MFA'. A 'QR code' and text secret will appear.

Open a TOTP-compatible authenticator app, such as Google Authenticator, Microsoft Authenticator, Authy, 1Password, or Bitwarden, and scan the QR code or enter the text secret manually.

Your authenticator app will generate a six-digit code that changes every 30 seconds. Enter the current code in MailerLogic and click 'Verify & Enable'.

Step 3: Check MFA Status

Once verification is complete, the MFA status changes to 'Enabled'.

Save the text secret in a secure password manager before leaving the setup screen. You can use it to add MailerLogic to a new authenticator app if you lose or replace your phone. If you lose both your phone and the saved secret, you'll need to contact Support to regain access.

Sign in with MFA

After MFA is enabled:

Enter your email address and password.
Open your authenticator app.
Enter the current six-digit code.

The code changes every 30 seconds. If a code is rejected, wait for the next code and try again.

Turn off MFA

If you need to move MFA to another device, you can switch the MFA toggle off from Profile. If possible, set up MFA on the new device immediately after disabling it.

Follow These Security Practices

Use a strong, unique password

Use a long password made up of several unrelated words, and never reuse your MailerLogic password on another service. A password manager can help you create and store unique passwords.

If you think your password has been exposed, change it immediately.

Protect your API keys and SMTP credentials

API keys and SMTP credentials can provide access to your MailerLogic services, so treat them like passwords.

Rotate credentials immediately if they are exposed in a repository, ticket, chat, or screenshot.
Use scoped API keys for third-party tools instead of a full-access account key.
Use separate SMTP credentials for different applications so you can revoke one without affecting others.
Review your integrations regularly and revoke access you no longer need.

Manage team access carefully

If other people use your MailerLogic account:

Give each person their own login. Never share credentials.
Assign the minimum role they need to perform their work.
Remove a user's access as soon as they leave your organization.
Encourage every team member to enable MFA on their own account.

See Teams & User Invitations for more information.

Watch Out for Phishing

Be cautious with unexpected messages that:

Claim your account will be suspended or deleted unless you act immediately.
Ask you to verify your password, API key, or SMTP credentials.
Direct you to a login page that is not the official MailerLogic domain.
Create unnecessary urgency or pressure you to act quickly.

MailerLogic will never ask you for your password, API key, or SMTP credentials by email, support ticket, or phone call.

If you're unsure whether a message is legitimate, don't use the link in the message. Instead, open MailerLogic directly in your browser and check your account.

If You Think Your Account Has Been Compromised

If you suspect unauthorized access, act quickly:

Change your MailerLogic password.
Enable MFA if it isn't already enabled.
Rotate your API key and SMTP credentials.
Go to Integrations → Apps and revoke integrations you don't recognize or no longer need.
Review your team members and remove unauthorized users.
Check your campaigns and reports for emails you didn't send.
Review your webhooks for endpoints you don't recognize.
Contact MailerLogic Support and explain what happened.

If unauthorized emails were sent from your account, contact Support as soon as possible. Quick action can help limit damage to your sending domain's reputation.

Frequently Asked Questions

Is MFA required?

No. MFA is optional, but strongly recommended for all users, especially account owners who manage billing and team access.

I lost my phone. How can I access my account?

If you saved the MFA text secret during setup, use it to add MailerLogic to a new authenticator app. If you don't have the secret, contact Support to verify your identity and regain access.

Which authenticator app should I use?

Any TOTP-compatible authenticator app is supported. You can use apps such as Google Authenticator, Microsoft Authenticator, Authy, 1Password, or Bitwarden.

Can I use SMS for MFA?

The source documentation specifies authenticator apps for MFA. SMS codes are not listed as a supported MFA method.

Does MFA protect my API and SMTP access?

No. MFA protects interactive account sign-in. API keys and SMTP credentials authenticate separately, so they must be secured and rotated independently.

Can I require MFA for everyone on my team?

Each user enables MFA on their own account. Encourage your team members to enable it, starting with the account owner.

Was this article useful?

Dislike