Confirm the mailbox accepts outside mail before triggering 2FA

The requirementstatement

The brand contact mailbox must be able to receive external mail before Authentication+ 2FA is triggered.

Severityseverity: HighHIGHRejected by at least one carrier or provider, and a common cause of failure at the rest.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: brand.business_contact_email deliverability
Where it liveslayer: BrandBRAND
How Ekas settles itdetectability: Post-submissionUNDETECTABLE_PRE_SUBMISSION; The subject does not exist yet at submission time: a reply window, an expiring PIN, a queue position. Reported with its deadline.
What the fix involvesfailureClass: Wait on someone elseTERMINAL_EXTERNAL; Needs an external system or a waiting period, such as IRS propagation, a vetting result, or a carrier queue.
Who requires itauthorities: Twilio
When it appliesapplicabilityText: Applies when the brand is a public company.

Why this rule existsrationale

Corporate mail filters reject or quarantine unfamiliar senders, and a verification mail that is silently dropped looks identical to one that was never sent — the brand waits in an authentication-required state and nobody knows why. Larger companies, which are exactly the ones registering as public, have the strictest filters.

How to fix itremediation

Send a test message from an outside domain to this mailbox and confirm it lands in the inbox rather than in quarantine. Where IT filters unknown senders, have the provider's sending domain allow-listed before the vet is ordered.

Provider rejection codescodes

The code you get back when this rule is what failed, and whether that provider lets you resubmit.

Provider	Code	Resubmit
Twilio	21738	Yes

Check this yourselfattestation

No tool can settle this one for you. Here is the check, and what wrong looks like.

Has a test message from an outside domain reached this mailbox's inbox, rather than its quarantine?

1Send the test from a personal account and have the contact confirm it landed in the inbox — not in a junk folder or a quarantine digest.
2In a filtered corporate environment, get the provider's sending domain allow-listed by IT before the vet is ordered.
3The 30-day vet window runs whether or not the mail arrived, so do this first.

What wrong looks like: A silently quarantined verification mail is indistinguishable from one that was never sent. The brand waits in an authentication-required state and nobody knows why.

Notesnotes

Deliverability is only observable after the mail is sent. What the user has to do is test it first — one message from a personal account — and, in a filtered environment, get the verification sender allow-listed before ordering the vet, because the 30-day window (BRD-226) runs whether or not the mail arrived.

Rules you will hit next

Other brand rules at the same severity. A registration is judged as a whole, not rule by rule.

BRD-006Submit every name line above the address on a multi-line IRS recordHighHIGH BRD-007TCR takes only the first line of the IRS-registered nameHighHIGH BRD-010Take the legal name from the CP-575 or 147C, never a W-2 or W-9HighHIGH BRD-014An acquired business registers the details it filed taxes underHighHIGH BRD-027EIN must be old enough to have propagated to IRS recordsHighHIGH BRD-034Validate a non-US identifier against its home register before submittingHighHIGH

All brand rules

BRD-119 is one of 196 brand rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.