Password Breach and Brute Force Lockout Notifications and Unverified Emails

When using Auth0 Email verification, Email delivery management, and Notification settings, it is essential to manage how identity-related notifications are sent to users. This article addresses a common concern: whether notifications, such as password breach alerts or brute-force protection messages, are sent to unverified email addresses.

• This can be problematic if users have not verified their email addresses, as sending notifications to incorrect or invalid addresses could result in delivery failures.
• Repeated failures may lead to SMTP providers blocking email operations due to suspected misuse or spam.

• Email verification
• Email delivery management
• Notification settings

Currently, Auth0 sends password breach and brute-force lockout notifications to unverified email addresses. This behavior is by design and cannot be changed directly through the Auth0 platform.

Recommendations

Enable native email verification directly within the User Sign Up flow. By enabling this feature, ensure that critical security notifications are sent only to verified, active email addresses, thereby protecting the SMTP reputation and reducing bounce rates.

Enable this directly within the Auth0 Management Dashboard by following these steps:

1. Navigate to the Management Dashboard.
2. Access the Database menu and choose the connection requiring an update.
3. Click on the Attributes tab.
4. Locate the Email attribute and click Configure.
5. Toggle on Verify email on sign up.