{
  "id": "BRD-119",
  "slug": "brd-119",
  "title": "Confirm the mailbox accepts outside mail before triggering 2FA",
  "statement": "The brand contact mailbox must be able to receive external mail before Authentication+ 2FA is triggered.",
  "rationale": "Corporate mail filters reject or quarantine unfamiliar senders, and a verification mail that is silently dropped looks identical to one that was never sent — the brand waits in an authentication-required state and nobody knows why. Larger companies, which are exactly the ones registering as public, have the strictest filters.",
  "layer": "BRAND",
  "layerSlug": "brand",
  "object": "brand.business_contact_email deliverability",
  "severity": "HIGH",
  "detectability": [
    "UNDETECTABLE_PRE_SUBMISSION"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "Twilio"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "21738",
      "remediable": true
    }
  ],
  "applicability": {
    "entityTypes": [
      "PUBLIC_PROFIT"
    ]
  },
  "applicabilityText": "Applies when the brand is a public company.",
  "universal": false,
  "remediation": "Send a test message from an outside domain to this mailbox and confirm it lands in the inbox rather than in quarantine. Where IT filters unknown senders, have the provider's sending domain allow-listed before the vet is ordered.",
  "notes": "Deliverability is only observable after the mail is sent. What the user has to do is test it first — one message from a personal account — and, in a filtered environment, get the verification sender allow-listed before ordering the vet, because the 30-day window (BRD-226) runs whether or not the mail arrived.",
  "phase": "approval",
  "automated": false,
  "attestation": {
    "question": "Has a test message from an outside domain reached this mailbox's inbox, rather than its quarantine?",
    "howToCheck": [
      "Send the test from a personal account and have the contact confirm it landed in the inbox — not in a junk folder or a quarantine digest.",
      "In a filtered corporate environment, get the provider's sending domain allow-listed by IT before the vet is ordered.",
      "The 30-day vet window runs whether or not the mail arrived, so do this first."
    ],
    "failureLooksLike": "A silently quarantined verification mail is indistinguishable from one that was never sent. The brand waits in an authentication-required state and nobody knows why."
  },
  "url": "https://ekas.io/rules/10dlc/brand/brd-119/",
  "markdown": "https://ekas.io/rules/10dlc/brand/brd-119.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}