Proton Mail email authentication: SPF, DKIM and DMARC
Proton Mail shows the exact records for your custom domain inside the account, so the job is copying them correctly and not breaking what is already there. This guide explains each record, where it comes from and what to check before you tighten DMARC.
Record values checked against Proton Mail’s own documentation on 2026-11-10. Every section links its source.
Check your domain against Proton Mail
Enter the domain you send from. We run the checks on the live DNS and show what is missing.
Free, no signup. The scan reads public DNS records only.
MX records for Proton Mail
| Type | Name | Priority and host |
|---|---|---|
| MX | @ | 10 mail.protonmail.ch |
| MX | @ | 20 mailsec.protonmail.ch |
- Add both MX records. Proton says to delete existing MX records or make sure the Proton records have the lowest priority number.
- Add all your email addresses in Proton Mail before you change MX, so nothing bounces. Propagation can take up to a day.
- Open Settings > Domain names > Review next to your domain > MX. Proton shows a green tick once its MX record is your top record.
SPF for Proton Mail
The mechanism to add is include:_spf.protonmail.ch. A domain can publish only one SPF record, so you add it to the record that exists, you do not create a second one.
Proton Mail is your only sender
v=spf1 include:_spf.protonmail.ch ~allMerging into an existing record
Before
v=spf1 ip4:203.0.113.25 include:_spf.crm.example ~allAfter
v=spf1 ip4:203.0.113.25 include:_spf.protonmail.ch include:_spf.crm.example ~allLookup budget
SPF allows 10 DNS-querying terms in total (RFC 7208), nested includes included. This include costs 2 DNS lookups (the include itself plus whatever it points to), measured by querying DNS on 2026-11-10. That leaves 8 for every other sender. Providers change their records, so re-measure with the SPF checker before you add the next one.
- Proton says to make sure you have only one SPF record. If one exists, delete it or change it to include the Proton value.
- Proton shows the record on the SPF tab of the Domain names page. Its registrar guides show v=spf1 include:_spf.protonmail.ch ~all (some add the mx mechanism).
- The include costs 2 DNS lookups in total, measured on the verification date: _spf.protonmail.ch itself and a second include it points to.
DKIM for Proton Mail
Where: Proton Mail: Settings > Domain names > Review next to your domain > DKIM
- Open the DKIM tab for your domain in Proton Mail.
- Create three CNAME records at your DNS host with the names shown there: protonmail._domainkey, protonmail2._domainkey and protonmail3._domainkey.
- Paste each target exactly as Proton shows it. Proton says you must add all three.
- If your DNS host is Cloudflare, set the proxy status to DNS only.
| Type | Name | Value |
|---|---|---|
| CNAME | protonmail._domainkey | <target from the DKIM tab> |
| CNAME | protonmail2._domainkey | <target from the DKIM tab> |
| CNAME | protonmail3._domainkey | <target from the DKIM tab> |
Selector. Proton uses three fixed selectors: protonmail, protonmail2 and protonmail3. The CNAME targets are per domain and only shown in your Proton account.
- Proton checks the records automatically and shows a green check once each is verified. That can take minutes to hours, depending on your previous TTL.
DMARC with Proton Mail
DMARC passes when SPF or DKIM passes and aligns with the domain in the From address. Start by watching, not blocking.
- Proton shows the DMARC value on the DMARC tab of the Domain names page and publishes it at _dmarc. DMARC is optional in Proton’s guides.
- Proton recommends a p=quarantine policy for most domains. If only Proton sends as your domain that is a reasonable first step. If other services also send as your domain, start at p=none with a rua address, read the reports, and only then move up.
Step 1
Monitor
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comPublish at _dmarc.<your-domain>. Nothing changes for delivery; receivers start sending aggregate reports to the rua address. Collect two to four weeks of reports, list every service that sends as your domain, and fix each one that fails SPF or DKIM alignment.
Step 2
Quarantine
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.comFailing mail goes to spam. Start with a small pct and raise it in steps (10, 25, 50, 75, 100) while the reports stay clean. pct is a rollout tool, not a permanent setting.
Step 3
Reject
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comFailing mail is refused. This is the goal for any domain that sends mail. Keep the rua address so you notice when a new sender breaks.
A rua address on a different domain than the one you protect needs an authorisation record published by the receiving domain (<your-domain>._report._dmarc.<report-domain> as a TXT record with the value v=DMARC1;), otherwise receivers will not deliver the reports. Subdomains inherit the DMARC record of the parent domain unless they publish their own.
Common Proton Mail mistakes
- Adding only some of the three DKIM CNAMEs. Proton states all three are needed.
- Leaving the old provider MX records at a lower priority number than the Proton records, so mail keeps going to the old provider.
- Switching MX before all addresses exist in Proton, so mail to missing addresses bounces.
- Keeping a previous SPF record and adding Proton as a second one. Merge into one.
- Proxying the DKIM CNAMEs through Cloudflare. Set them to DNS only.
- Adopting p=quarantine without checking other senders. Newsletters or invoicing tools that send as your domain will be quarantined.
Proton Mail email authentication FAQ
What are the MX records for Proton Mail?
mail.protonmail.ch at priority 10 and mailsec.protonmail.ch at priority 20. Add both and remove, or give a higher number to, any other MX record.
What is the SPF record for Proton Mail?
Proton’s guides show v=spf1 include:_spf.protonmail.ch ~all. Keep only one SPF record on the domain and merge the include if you already have one.
Which DKIM selectors does Proton Mail use?
protonmail, protonmail2 and protonmail3, as CNAME records at <selector>._domainkey. The targets are shown on the DKIM tab for your domain in Proton Mail.
Does Proton Mail require DMARC?
It is optional in Proton’s guides, but Google, Yahoo and Microsoft ask bulk senders for a DMARC record. Proton recommends p=quarantine for most domains.
Can I have SPF records for both Proton Mail and my other senders?
Yes, but in one record. A domain must publish exactly one v=spf1 TXT record. Add each sender as an include or an ip4/ip6 term to that record. Two records give a permerror and both are ignored.
How do I check my Proton Mail authentication after changing DNS?
Enter your domain in the check on this page. It runs the IntoDNS.ai scan, the SPF checker (which counts DNS lookups) and, where the selector is known, the DKIM checker. DNS changes can take time to propagate, so re-check later.