BREAKING: Cloudflare Access PIN Emails Blocked by Proofpoint [MINOR]

Cloudflare Access one-time PIN emails are being blocked by certain email security gateways including Proofpoint. Immediate workarounds available. Status: investigating.

BREAKING: Cloudflare Access One-Time PIN Emails Blocked

Status: MINOR | Partial Disruption | Investigating

Last Updated: Now

---

What's Down & Who's Affected

Cloudflare Access one-time PIN (OTP) emails are currently being blocked by certain enterprise email security gateways, specifically Proofpoint and similar solutions.

If you're affected:

Users attempting to log in via Cloudflare Access receive no PIN email

Primarily impacts teams/organizations using Proofpoint, Microsoft Defender for Office 365, or similar gateway filters

Personal email accounts (Gmail, Outlook personal) mostly unaffected

This is a partial disruption—not all users experience issues

Who needs to act now:

SaaS products protected by Cloudflare Access

Internal tools behind Cloudflare Access

Teams with corporate email security gateways

---

Immediate Workarounds (Do These Now)

1. Enable Cloudflare Access Backup Codes

Ensure backup codes are generated and stored securely

Users can use these codes instead of PIN emails during this incident

Dashboard: Settings → Authentication → Generate Recovery Codes

2. Whitelist Cloudflare Sender IPs

Contact your email security gateway admin

Whitelist Cloudflare's OTP email sender domains

Proofpoint admins: Add noreply@cloudflareaccess.com to trusted senders

Allow Cloudflare IP ranges: See your gateway's documentation

3. Switch to Alternative Auth Methods

Use SAML/OIDC providers (Okta, Auth0, Azure AD) instead of OTP emails

Enable service tokens for API/service-to-service auth

Configure TOTP authenticator apps (Google Authenticator, Authy) as backup

4. Temporary: Adjust Email Gateway Rules

Reduce OTP email filtering sensitivity temporarily

Ask security team to flag Cloudflare Access emails as safe

This is NOT a long-term fix—coordinate with your security team

---

How to Check If Your Project Is Affected

1. Test login: Attempt to access your Cloudflare Access protected resource 2. Check email: Wait 2 minutes for PIN email (may not arrive) 3. Check logs: Cloudflare dashboard → Logs → Look for failed authentication attempts from your IP range 4. Ask users: Have you received PIN emails today? Start a quick Slack poll 5. Email gateway check: Contact your email admin—ask if Cloudflare emails are being filtered

---

Alternative Tools to Consider

If you're regularly impacted:

Okta / Azure AD: Enterprise SSO (swap out Cloudflare Access OTP entirely)

Auth0: Managed authentication service with multiple delivery methods

Duo Security: Email + SMS + push authentication

Teleport: Self-hosted access control (more control, more overhead)

WireGuard + custom auth: Lower-level alternative (technical debt trade-off)

---

How to Monitor Recovery

1. Check Cloudflare Status Page: https://www.cloudflarestatus.com/ (watch for updates) 2. Test periodically: Try login every 15 minutes 3. Monitor email delivery: Have a test user attempt login and time the email arrival 4. Follow this incident: We'll update as Cloudflare resolves 5. Subscribe to alerts: Enable Cloudflare email notifications in dashboard

---

Bottom Line

This is not a Cloudflare outage—it's a compatibility issue between Cloudflare's OTP delivery and enterprise email gateways. Workarounds exist *now*. Use backup codes, enable alternative auth, or whitelist Cloudflare. Full recovery expected within 24-48 hours once Cloudflare coordinates with gateway providers.

Stay calm. You have options.