Diagnose Cloudflare one-time PIN delivery without treating the login banner as proof

Access deliberately displays the same email-sent message for blocked addresses.

Source facts

Cloudflare Access sends a one-time PIN only when the email address is permitted by an Access policy. Its login page nevertheless displays an email-sent message for blocked users, so that banner does not prove delivery was attempted. PINs are single-use, expire after the documented validity window, and requesting another PIN invalidates the previous one. Email-security link scanning can consume a code before the user submits it. Access records an authentication attempt after code submission, rather than merely after the user enters an email address.

Source: Cloudflare — One-time PIN.

Applicability

This applies to Cloudflare Access One-time PIN authentication. It is separate from an identity provider’s own email codes, password resets, or multifactor prompts.

DSE recommendation

DSE recommends checking the effective Access policy before diagnosing the mail transport. Confirm the exact recipient address and intended application, then review the gateway’s handling of Cloudflare’s documented sender. Request one fresh code and use only the newest message. If scanning consumes the code, review a narrowly scoped mail-security exception with the email administrator. Do not broadly disable link protection or infer that an absent authentication log means no email was requested. Keep the user’s inbox content and PIN out of support notes.

Verification

With approved test identities, compare an allowed address and a denied address. Review mail tracing only for the allowed case, and confirm an older code fails after requesting a new one. Submit a controlled code to verify when the authentication log appears.

Official reference

Cloudflare — One-time PIN. Reviewed October 15, 2026.