Handler captures ZoneEdit login verification tokens from email and publishes them to WebDAV so a Tampermonkey userscript can auto-fill the 2FA form. Currently ENABLED (uncommented) in process_emails.py.
From: support@zoneedit.com (easyDNS / EasyZone Corp). To: jsr_critchley@hotmail.com.
Two observed subject/body formats, both handled: older [ZoneEdit] Access token for login attempt on new device with body Access Token: 349294; newer [ZoneEdit] Your access token with body Your ZoneEdit 2nd-Factor token is: 139886. Token expires 5 minutes after receipt.
File: ~/py/popit3/zoneedit_handler.py. Filters by sender + subject regex, extracts token, and on match:
WebDAV upload uses webdav4.client.Client against webdav.critchley.biz, credentials from ~/.netrc. This WebDAV path requires basic auth — it is not the notes system, whose HTML interface is public, so this is safe to publish tokens to.
Tampermonkey script at ~/py/popit3/zoneedit-2fa.user.js runs on cp.zoneedit.com/tfa.php, polls https://webdav.critchley.biz/john/zoneedit/token.txt every 3s, and auto-fills+submits the token if it's newer than page-load time and under 10 minutes old.
Credential handling (2026-07-03): the userscript never contains the WebDAV password. Credentials are entered once via a Tampermonkey menu command ("Set WebDAV credentials", registered with GM_registerMenuCommand) and stored in the script's own GM_setValue storage, then read back with GM_getValue on each poll. If unset, the status bar shows a red prompt to use the menu. This was chosen over baking credentials into a generated file because the popit3 GitHub repo is public — the committed script has no placeholder or secrets file to keep in sync with ~/.netrc.
popit3 runs every 5 minutes; token expires in 5 minutes. Trigger a manual ./popit3.py run right after requesting the ZoneEdit login token to maximise the window before expiry.