Can confirm, this is still a bug (or a feature?) in GoDaddy's "Full Domain Privacy & Protection" plan.
Domain Privacy was set to use newer proxy info, and it pulls mostly correct data on WHOIS requests publicly. But any changes I was attempting for DNS updates were routing through old manual WHOIS directory info which was an old (before my time) proxy service. They were sending 2FA to an email address that wasn't fulfilling any forwarding as it was a shuttered service. While WHOIS was being fulfilled by the new proxy data, the old manually typed email address was handling some things. Fuuuuu.
I was told by their support to go through some recovery process - which I did. Involved sending copies of my boss's and mine IDs and then selfies with our IDs for verification. What fun. All that did was put the *account* in my email address. Nothing about the old WHOIS that I was trying to update so I could get the 2FA emails to deliver. Much ado about nothing.
I get in to work today to find this gem after beating my head into the desk for 10-20m and all of last week and a half with these folks to find that:
-1. "It's an old code, but it still checks out." They use Imperial Star Wars rules when validating their OTPs. *i.e., They don't expire*
-2. That's not true at all, any random 6-digit code will validate and let you make the change(s). *Confirmed and made my changes. The codes are made up and don't matter.*
-3. If you ever do have a valid email working, it could take up to 10m for delivery. *Haven't had to test this yet, but other admins are confirming that this is painful when making infrequent changes.*
I've at least finally updated the Admin email so it can be technically correct on the backend of that one domain. Now to play this whack-a-mole game for all the other domains.
https://www.reddit.com/r/webflow/comments/1ahkhha/godaddy_is_starting_to_ask_for_verification_every/