emailsecops
Menu
Guides

Proton Mail SPF, DKIM and DMARC setup

Verify the domain, point MX to mail.protonmail.ch and mailsec.protonmail.ch, add include:_spf.protonmail.ch to your root SPF record and publish the three DKIM CNAMEs from Proton's setup screen. DKIM aligns once Proton detects them.

Mailbox provider · reviewed October 13, 2026 against Proton Mail's documentation

Records to publish

Hosts are full names, with {domain} standing for your domain; most DNS panels want only the part before it (@ for the domain itself). Anything else in {braces} is specific to your Proton Mail account: copy it from Proton Mail's setup screen, which shows the exact record.

ForTypeHostValue
Domain verification TXT {domain} protonmail-verification={token}Copy it from Settings > Domain names > Verify, and keep it after verification.
Receiving mail MX {domain} priority 10 · mail.protonmail.chDelete other MX records, or give Proton's the lowest priority number.
Receiving mail MX {domain} priority 20 · mailsec.protonmail.ch
SPF TXT {domain} v=spf1 include:_spf.protonmail.ch ~allProton calls SPF not required but strongly recommended, and warns that -all can cause delivery problems.
DKIM CNAME protonmail._domainkey.{domain} protonmail.domainkey.{id}.domains.proton.ch{id} is specific to your domain; copy all three from Settings > Domain names > Review > DKIM.
DKIM CNAME protonmail2._domainkey.{domain} protonmail2.domainkey.{id}.domains.proton.ch
DKIM CNAME protonmail3._domainkey.{domain} protonmail3.domainkey.{id}.domains.proton.ch
DMARC optional TXT _dmarc.{domain} v=DMARC1; p=none; rua=mailto:{report-address}Proton's setup suggests p=quarantine but warns that quarantine or reject can hurt mail through mailing lists or forwarding.

SPF

Recommended, though Proton calls it not required: add include:_spf.protonmail.ch to the SPF record at your root domain, for example v=spf1 include:_spf.protonmail.ch ~all. It authorizes Proton's servers for your domain; Proton doesn't say which Return-Path domain it uses, so DKIM is the documented way its mail aligns.

DKIM

Three CNAMEs, protonmail, protonmail2 and protonmail3 under _domainkey, point to keys Proton hosts under domains.proton.ch; copy them exactly from the DKIM tab. Proton generates a new 2048-bit key every six months behind those CNAMEs, so the records never change, and it starts signing only after it detects them.

DMARC alignment

DKIM aligns: once the three CNAMEs verify, Proton signs mail from your custom domain with keys published under it. SPF may also align, but Proton doesn't document its Return-Path domain.

Common mistakes

  • Only one SPF record: merge include:_spf.protonmail.ch into an existing record right after v=spf1.
  • Use include:_spf.protonmail.ch: the include:_spf.proton.me printed on one Proton marketing page doesn't resolve, so an SPF record with it fails.
  • On Cloudflare, set the DKIM CNAMEs to DNS only, or the records won't propagate.
  • An old manual DKIM TXT record must be deleted before you add the CNAMEs, and DKIM stops signing once it's gone, so add the CNAMEs right away.
  • Keep the protonmail-verification TXT after verification, because Proton re-checks domain ownership with it.
  • Create your addresses in Proton before switching MX, or mail to addresses that don't exist yet is lost.

Check that it worked

DNS changes can take a few minutes to show. Then run the free checks, no account needed:

How EmailSecOps recognises Proton Mail

A domain check names the services it finds in your DNS, leftovers from older setups included, so you can see which senders are set up and which are missing a key:

  • SPF include, current or legacy: _spf.protonmail.ch
  • Default DKIM selectors: protonmail, protonmail2, protonmail3
  • DKIM keys delegated (CNAME) to *.domains.proton.ch

Questions

What SPF record does Proton Mail need?+
Recommended, though Proton calls it not required: add include:_spf.protonmail.ch to the SPF record at your root domain, for example v=spf1 include:_spf.protonmail.ch ~all. It authorizes Proton's servers for your domain; Proton doesn't say which Return-Path domain it uses, so DKIM is the documented way its mail aligns.
What are the DKIM records for Proton Mail?+
Three CNAMEs, protonmail, protonmail2 and protonmail3 under _domainkey, point to keys Proton hosts under domains.proton.ch; copy them exactly from the DKIM tab. Proton generates a new 2048-bit key every six months behind those CNAMEs, so the records never change, and it starts signing only after it detects them.
Does Proton Mail mail pass DMARC?+
DKIM aligns: once the three CNAMEs verify, Proton signs mail from your custom domain with keys published under it. SPF may also align, but Proton doesn't document its Return-Path domain.
Do I need a separate DMARC record for Proton Mail?+
No. A domain has one DMARC record, a TXT record at _dmarc.yourdomain.com, and it covers every service that sends as the domain. What each service needs is SPF or DKIM that aligns with your From domain; once every sender aligns, the policy can move from p=none to quarantine and then reject.

Sources