GoDaddy names Google Voice as unusable for verification codes

The sentence to read before you buy anything

• GoDaddy Help, on verification methods

  “You can not use a telephone service like Conversations or Google Voice for SMS text messaging with a verification method.”

  https://www.godaddy.com/help/enable-an-identity-verification-method-for-your-godaddy-account-42665

Note what it says and what it does not. GoDaddy names two telephony services. It does not use the words VoIP, virtual number or landline anywhere on the pages we read, and it does not publish the test it applies. So the published rule is about services of that kind, and how far enforcement reaches beyond the two names is not something GoDaddy states — or something anyone selling numbers can honestly tell you.

A Cleat line is a real US mobile number on a carrier network rather than a calling app layered over the internet, which is a different thing from the two services GoDaddy names. That is a reason to think it behaves like a mobile, not a promise that it will be accepted. What makes a number non-VoIP sets out how these checks are run and where they get it wrong.

GoDaddy ranks SMS last

Its comparison page grades the three tiers outright: an SMS text message is “Good”, an authenticator app is “Better”, and a hardware security key is “Best” (GoDaddy). The setup page marks its own mobile app as recommended and describes the phone option as “a convenient option, but may not be as reliable as authenticator apps”, suggesting a passkey “if you're a domain investor or want the highest level of security” (GoDaddy).

On cadence, there are two settings rather than one. With 2-step verification switched on, “you can require 2-step verification every time you sign in to your account and for all high-risk actions (like changing your password)” (GoDaddy). With a method enrolled but 2-step verification off, GoDaddy prompts only on high-risk actions or suspicious sign-in attempts.

Two numbers, and they do not follow each other

A detail that catches people out: your profile phone number and your verification phone number are separate records, and GoDaddy warns that “Changes to one do not automatically update the other” (GoDaddy). Updating your contact details does not move your second factor.

Changing the number

There is no edit-in-place. GoDaddy's instructions are a delete and then an add, and you need the old method working to get through the first half (GoDaddy):

1. 01Go to your Security page and sign in, satisfying the verification you already have.
2. 02Under Verification Methods, choose Edit, then Remove on the old number.
3. 03Choose Add verification method, then Phone number.
4. 04Enter the new number and choose Send verification code.
5. 05Enter the six-digit code, then Next.

If the old device is gone, GoDaddy sends you elsewhere: “If you don't have access to the device you used when you set up identity verification, see Cancel an identity verification method” (GoDaddy). Worth knowing before you start hammering resend: “we locked this verification method for 24 hours due to too many code requests” (GoDaddy).

What recovery costs

More than you would like. GoDaddy's troubleshooting page states the outcome plainly: “you'll regain access to your account, but all your existing identify verification methods will be removed” — the typo is GoDaddy's (GoDaddy). When automated matching fails, it escalates to a form, and the cancel-a-method page says the process may involve “collecting and processing your biometric information through our vendor, Persona” (GoDaddy).

Delegates do not share your factor

GoDaddy's team model is delegate access, and it is built the right way round: delegates act “without having to share passwords or other secure information” (GoDaddy), and “Delegates must have a GoDaddy account to accept your invitation” (GoDaddy). Each person signs in as themselves. So a shared line does not cover a team here; it covers the one login that owns the domains.

Where a Cleat line fits

On the owner login of a portfolio that belongs to a company rather than to a person: a business whose domains should not be hostage to a founder's old handset, or an owner abroad whose US mobile is gone. A Cleat line is a real US mobile number, not VoIP, held by one identity-verified person, readable by a team in a shared inbox, at $24.99 a month. For an agency holding client domains, the model on Cleat for teams is the clean one: the client owns the line and invites you.

When Cleat is the wrong answer here

• GoDaddy's rule might reach further than the two names it prints. It publishes no test. Test the line before you remove your existing method, not after.
• A security key or an authenticator app is available. GoDaddy ranks both above SMS, and on a registrar account that ranking is the whole argument.
• You want delegates to share one factor. They each need their own GoDaddy account, which is the safer design anyway.
• You need to send or answer anything. The line receives only, and it cannot reach 911.

Keep reading

AWS · Google Workspace · QuickBooks · Every service in this section