A login feature most mail servers built for Europe or the US never needed
SMS one-time-password login isn't a checkbox feature, it's what happens when a mail platform is actually built for a market where SMS is a more reliable second factor than an authenticator app half the user base has never installed. FanMail supports SMS OTP and 2FA at login, plus opt-in email-to-SMS notifications, as first-class features rather than a plugin bolted onto a commercial suite that assumes everyone already has TOTP set up.
Why this is a real gap, not a nice-to-have
Roll out a commercial webmail suite to 10,000 university staff and students, and a meaningful share will never complete 2FA enrollment if the only option is an authenticator app, support tickets pile up, and IT quietly disables enforcement to stop the bleeding. SMS as a first-class second factor removes that adoption cliff entirely, because everyone already knows how to receive a text.
Email-to-SMS: the other half of the same idea
Opt-in email-to-SMS notifications mean a critical message doesn't sit unread in an inbox nobody's checking outside business hours, a small feature that matters disproportionately for institutions where email still isn't everyone's primary channel yet.
The pattern underneath both features
Neither of these exists because a feature-comparison spreadsheet demanded it. Both come from FanMail being built for the market it actually runs in, not translated from one that assumes different defaults, the same reason self-hosting mattered enough to replace a $70,000/year IceWarp bill in the first place.
Frequently asked questions
Does FanMail support SMS OTP login?
Yes. FanMail supports SMS one-time passwords and two-factor authentication at login as first-class features, not a plugin bolted onto a commercial suite. It also offers opt-in email-to-SMS notifications, so a critical message reaches someone even when nobody is checking the inbox outside business hours.
Why offer SMS as a second factor instead of only an authenticator app?
When an authenticator app is the only option, a meaningful share of a large user base, such as 10,000 university staff and students, never finishes 2FA enrollment. Support tickets pile up and IT quietly disables enforcement. Everyone already knows how to receive a text, so SMS removes that adoption cliff.
Is SMS OTP phishing-resistant?
No. SMS codes and authenticator app codes are not phishing-resistant. An adversary-in-the-middle proxy page can relay them in real time, which is the main finding in our read of Microsoft's 2026 Digital Defense Report on AiTM phishing. SMS improves 2FA adoption, but it does not stop real-time relay attacks.
One honest limit: SMS and authenticator codes are not phishing-resistant. A proxy page can relay them in real time, which is the main finding in our read of Microsoft's 2026 Digital Defense Report on AiTM phishing.
