You can either use the /api/v1/edit/domain-admin API endpoint and edit the domain admins with this payload:
{
"attr": {
"force_tfa": "1"
},
"items": "<username>"
}
You just need to replace the <username> with the actual usernames of the domain admins (as far as I know, only one admin per request), or you can use a mysql query to update every domain admin in the admin table. You could use this query for example:
UPDATE admin SET attributes = JSON_SET(attributes, '$.force_tfa', '1') WHERE superadmin = '0';
To update all domain admins and enable the 2fa enforcement.
You can use this block of commands for the update:
source mailcow.conf
docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT username, superadmin, attributes FROM admin WHERE superadmin = '0';"
docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "UPDATE admin SET attributes = JSON_SET(attributes, '$.force_tfa', '0') WHERE superadmin = '0';"
docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT username, superadmin, attributes FROM admin WHERE superadmin = '0';"
It first displays all domain admins, then updates then and then displays them again, so you can check.
But I take no responsibility if something goes wrong, if you do the database changes yourself.