Every service you sign up for asks for an email address, and most of them keep it longer than you expect. That address then appears in breach datasets, marketing lists and credential-stuffing attempts, often years later. The address itself is rarely the secret, but it is the key that links accounts together. Handling it carefully when you register is one of the cheapest privacy measures available, and it costs almost nothing once it becomes a habit.
Why the address matters
If you use one address everywhere, a leak from any one service connects you to all the others. Attackers try leaked email and password pairs against other sites, a technique known as credential stuffing. They also sell address lists to senders of unwanted mail. Separating services by address makes it possible to see where a leak came from, and to stop mail from a service you no longer trust without losing the rest of your inbox.
Plus addressing
Plus addressing, also called subaddressing, lets you add a tag after a plus sign in the local part of your address. On ITProMail, mail to you+tag@itpromail.com is delivered to your mailbox, so you can give each service its own tag:
shop-example@itpromail.com
newsletter-news@itpromail.com
forum-example@itpromail.com
Mail arriving with a tag tells you which service sent it or sold the address. Filters can sort tagged mail into folders, which is covered in the subaddressing documentation.
Plus addressing has limits you should understand. The tag is visible to the service and to anyone who receives a copy of the address, so it does not hide your base address. Some services reject plus signs in registration forms. Some senders strip tags when they build lists, which removes the separation. Treat tags as a way to track and filter, not as a way to hide who you are.
Aliases
Aliases are separate addresses that forward to your mailbox. Unlike a tag, an alias is a distinct address that can be created, changed and removed without touching your login. Aliases are useful when a service insists on a specific address you do not want to give out, or when you want to stop mail from one source without changing your main address. Aliases are managed under Account > Aliases, and the number you can create depends on your plan: Recon includes 2, Operator includes 10, and Shadow includes unlimited aliases. See the aliases guide for details.
Catch-all addresses
A catch-all address receives mail sent to any address at a domain, including ones you never created. It is convenient for disposable addresses, but it is also a magnet for spam and for guessed addresses from breaches. On Shadow, which supports catch-all with custom domains, consider whether you need it at all. Most people do better with specific aliases or tags, which can be retired individually.
Use a unique password for every service
Separating addresses does not protect a password that you reuse. A password that appears in a breach can be tried against any service that shares the same address and password. Use a unique, randomly generated password for each service, and store them in a password manager. A password manager also helps you notice when a site is not the one you saved, which defends against phishing.
For ITProMail itself, keep your login password separate from the app passwords you create for mail clients. App passwords let you revoke a device without changing everything else, and the list is under Account > Security.
Check what you are agreeing to
Before you enter an address, decide what you expect the service to do with it. Account notices and password resets are legitimate uses. Marketing is a separate choice, and most sign-up forms bundle the two. Untick optional marketing consent where it is offered, and use the alias or tag for that service so you can remove it later without losing account notices.
Keep a simple record
When a service receives a dedicated address, note it somewhere: a password manager entry, a spreadsheet or a plain text file that you keep private. The record lets you answer the questions that come up later. Which address did I use for this? Can I stop this sender? Is this mail from a service I have actually used? Without a record, the separation is hard to maintain.
A short routine
- Use a tag or alias for each new service, and record which one you used.
- Generate a unique password and save it in your password manager.
- Decline optional marketing at sign-up, and use the tag to manage what remains.
- When a service leaks or you stop using it, retire its address with a filter or by removing the alias.
None of this makes an account safe on its own. Pair it with a second factor, as described in the TOTP guide and the FIDO2 guide, and with the broader review in the security checklist. The point is to limit how much one leak can reveal, and to keep control of the address that everything else depends on.