Member security checklist

This checklist covers the account settings that matter most for keeping a mailbox under your control. Most items take a few minutes. Work through them once, then repeat the session review every few months. Account settings are under Account > Security unless noted.

1. Turn on two-factor authentication

Enable a second factor before anything else. ITProMail supports TOTP (an authenticator app) and FIDO2 security keys. If you can, enroll both: use the security key as your primary method and keep TOTP as a backup on a second device. See TOTP and FIDO2 keys.

A second enrolled method is what keeps a lost phone or key from locking you out. Check your options in account recovery while you are still signed in.

2. Use app passwords for mail clients

Mail clients connect over IMAP (imap.itpromail.com, port 993) and SMTP submission (smtp.itpromail.com, port 465 or 587). They authenticate with an app password, not your login password. Create one app password per device or client. You can have up to 20. A separate password for each means you can revoke a single device without changing anything else. See app passwords and IMAP and SMTP settings.

• Revoke the app password for any device you sell, lose or stop using.
• Never paste an app password into a shared document, a ticket or a chat.

3. Review active sessions

A webmail session stays valid for 30 days unless you revoke it. Open the sessions list under Account > Security and check it:

• Revoke any session you do not recognize, then change your password.
• Sign out on shared or public computers instead of leaving the session to expire.
• Revoke sessions from any browser or device you no longer use.

4. Set up your encryption keys deliberately

If you use PGP, manage your keys under Account > Encryption and publish them through Web Key Directory where your correspondents expect them. See PGP. Before you rely on a key:

• Protect the private key with a strong passphrase.
• Create a revocation certificate and store it offline, away from the key itself. With GnuPG it is created with gpg --gen-revoke you@itpromail.com > revoke.asc.
• Keep an offline backup of the private key, stored somewhere you can recover it.

5. Review filters, forwarding and aliases

Attackers who gain access to a mailbox often add a rule that forwards or copies mail somewhere else. Check the following for entries you did not create:

• Account > Filters. Read every Sieve script. See Sieve.
• Forwarding. See forwarding and auto-reply.
• Account > Aliases and Account > Domains. Remove any alias or domain you did not add.

6. Confirm your recovery path

Work out how you would regain access if you lost your primary device or key. Write down which method you would use, and test it while you still have access. Registration is closed, so the recovery path is the one way back into an account. See account recovery.

7. Keep an export

Keep a recent copy of your mail outside the service. Account > Export produces an mbox file, and any IMAP tool can copy your folders. See exporting your mailbox.

8. Know where to report

If you see a sign-in you did not make, a message that asks for your password, or a forwarding rule you did not create, contact security@itpromail.com. For background on the phishing techniques to expect, read spotting modern phishing.

Review schedule

• Every session: sign out on shared machines.
• Monthly: review sessions, app passwords and filters.
• Yearly: test account recovery and refresh your export.