Customers using 2FA at @HostGator should remove the DNS entries for webmail & cpanel subdomains.
2FA is not being enforced on those subdomains, hackers can get into accounts that way.
If you're not using those subdomains, you should remove them, even if not using HostGator.
