r/emailprivacy•
ghost-life

Should I let TOTP-only 2FA be a dealbreaker (Codamail)?

Advanced/Technical

I'm trying to choose an email provider for the long haul and Codamail ticks a lot of boxes for me but the only 2FA option is TOTP and I've really come to prefer Yubikey/Fido2. TOTP seems fairly robust other than phishing attacks that collect credentials and immediately attempt login (which I hope I can avoid). Yubikey feels more secure to me, but honestly part of why I prefer it is the convenience.

I've considered other providers but I'm not sure anyone else (that accepts Fido2 for 2FA) offers this particular combination of features:

  • BYO domain
  • Unlimited aliases for your domain
  • SMTP server allows aliases as the from address so you can always reply as the alias
  • Encrypt mail as it arrives at your inbox with your public PGP key (never revealing your private key) with the option to use it for all, some, or none of the aliases.

So, I'm just after some feedback on whether TOTP is good enough, or if I'm better off compromising on features and choosing another provider?

Posted Aug 3, 2026, 10:39 AM UTC

29
Loading comments…