As the question title says I was locked out of my admin page after upgrading to 2.4.0 due to the enforced 2FA. Now I see this page

enter image description here

The email that is sent though is not going to my user's email address but instead it goes out to owner@example.com. So I'm unable to follow the instructions. Clicking on change your password just makes me return to the same page and sends another email to owner@example.com

How do I recover from this situation?

--Additional info for troubleshooting --

After a lot of looking around in the logs, I experimented with adding a different address in owner@example.com . This had an interesting aspect because it made me receive a bounce message. It seems that magento 2 is trying to send the email as owner@example.com to the user email, however because SPF validation fails the message is silently discarded. The resulting email I saw towards owner@example.com was the bounce message of the original email.

I then experimented with adding an account I own the top level domain for, and edited the SPF record to allow sending the email. I received the email normally and unlocked my account.

However I'm still curious why it's picking up owner@example.com as the sender of the email and not the general contact email address.


Temporary you can disable this using this command :

php bin/magento module:disable Magento_TwoFactorAuth
php bin/magento cache:flush 

Then you can make the login, and if you want to enable it again then also do it from the command.

  • When disabling the module I get this error Base table or view not found: 1146 Table 'tfa_user_config' doesn't exist, query was: SELECT tfa_user_config.* FROM tfa_user_config – gabtzi Aug 1 '20 at 12:56
  • have you tun run command from the CLI from magento root? – Dhiren Vasoya Aug 1 '20 at 12:57
  • Yes, in the meantime I've added some info on the question on what I found regarding email sending. – gabtzi Aug 1 '20 at 13:01
  • create a new user with bin/magento admin:user:create

  • login with new user

  • manage the blocked user with admin controll


  • Same thing, the email is sent to owner@example.com for some reason – gabtzi Jul 31 '20 at 12:31
  • 1
    Ok go in database and look for core_config_data table. Query -> select * from core_config_data where path like '%factor%' With this query you will see all configuration standard for the module 2factor auth. Try to change the default email – Riccardo Ugolini Jul 31 '20 at 12:40
  • only these two paths are there - msp_securitysuite_twofactorauth/duo/application_key and - twofactorauth/duo/application_key – gabtzi Jul 31 '20 at 12:48
  • The module takes the email from user settings: 'user[email]' => $user->getEmail() Check please if the email of the user is correct – Riccardo Ugolini Jul 31 '20 at 13:01
  • Also the owner@example.com mail is only used here /vendor/magento/module-email/etc/config.xml:42 for transactional email – Riccardo Ugolini Jul 31 '20 at 13:04

It seems the message that was appearing to be sent to owner@example.com was a bounce message.

The original message was being sent correctly to the registered user. However because the config option


was not set in the system. It used the default system value of owner@example.com

This was causing the original TFA verification email to be sent from owner@example.com to user@example.com then bouncing back to owner@example.com due to SPF verification error.

Setting the config option on core_config_data table directly in the database didn't seem to have an effect. However by setting it on /vendor/magento/module-email/etc/config.xml I was able to make the SPF validation work and receive the email.

Afterwards it was easy to set up TFA.

I'm logging this answer here for future reference.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.