Setup guide
Proton Mail: SPF, DKIM and DMARC
Proton Mail on your own domain takes a protonmail-verification TXT record, two MX records, an SPF include, three DKIM CNAMEs (protonmail, protonmail2 and protonmail3) and a DMARC record, each listed under Settings → Domain names.
By Ahmet Karaca · Updated · Checked against Proton Mail documentation on
DNS records to add
@protonmail-verification=<value from Settings → Domain names → Review → Verify>Replace the part in angle brackets with your own value before publishing.
Domain verification; keep it after the domain is verified
@10 mail.protonmail.chPrimary incoming mail server
@20 mailsec.protonmail.chSecondary incoming mail server
@v=spf1 include:_spf.protonmail.ch ~allSPF: authorizes Proton's servers to send as your domain
protonmail._domainkey<copy from Settings → Domain names → Review → DKIM>Get this value from your provider's dashboard.DKIM key 1
protonmail2._domainkey<copy from Settings → Domain names → Review → DKIM>Get this value from your provider's dashboard.DKIM key 2
protonmail3._domainkey<copy from Settings → Domain names → Review → DKIM>Get this value from your provider's dashboard.DKIM key 3
_dmarcv=DMARC1; p=quarantineDMARC policy as suggested in Proton's DMARC tab (Proton's article calls p=none the default)
Steps
- On a Business plan, create your organization first. Then add the domain in Settings → Domain names.
- Publish the protonmail-verification TXT record at @, with a TTL of 300 if your DNS host offers it, and wait for Proton to verify the domain.
- In the Addresses tab, add every active address on the domain before you touch MX.
- Publish both MX records, then delete any other MX records or give Proton's the lowest priority number.
- Publish the SPF record, the three DKIM CNAMEs and the DMARC record, copying each host and value from its tab under Review.
- Wait for the green checks in Settings → Domain names, then send a test message to Mail Tester.
Common mistakes
- Deleting the protonmail-verification TXT record once the domain is verified is a mistake. Proton uses it to confirm that you still own the domain.
- Changing MX before the addresses exist in Proton loses mail. After the switch, messages to any address that isn't set up in Proton aren't delivered.
- If you rotated DKIM manually with a TXT record, Proton stops signing as soon as you delete it. Remove that TXT first and add the three protonmail CNAMEs right away.
- Some DNS consoles reject CNAME values that end with a dot, while some registrars require it. If yours refuses Proton's DKIM values, remove the trailing dot.
- Swapping Proton's ~all for -all turns SoftFail into HardFail, which can get legitimate mail rejected, for example messages that were forwarded.
Good to know
- If your DNS host rejects @ as a host name, leave the host empty or enter the full domain instead.
- When your nameservers point to another service, edit the DNS records there rather than at your registrar.
- Proton has dedicated setup guides for Porkbun, Squarespace, Wix, Namecheap, GoDaddy, Cloudflare, AWS, Hostpoint, Bluehost, OVH, Gandi and Infomaniak.
Frequently asked questions
Can I use a custom domain on Proton's free plan?
No. A custom domain needs a paid Proton plan, and every paid plan supports one.
Why are the protonmail DKIM CNAMEs missing from my domain settings?
Proton generates their host names and values only after the domain is verified, which can take a couple of hours. It sends you an email once they're ready.
What do the three protonmail CNAMEs give me over a single TXT key?
Automatic key rotation. With the CNAMEs in place, Proton moves to a new 2048-bit key every six months.
When will Settings → Domain names show green checks?
Proton checks the records automatically, which takes minutes to hours depending on the TTL of your previous records. Some platforms keep old settings for 1–3 days.
Is Proton's DMARC default none or quarantine?
Proton's anti-spoofing article calls p=none the default but recommends p=quarantine, which is what the DMARC tab suggests, and p=reject once you're confident. Mailing lists can break SPF and DKIM, so keep them in mind before tightening the policy.
Adding records at your DNS host
Check your setup
After publishing, use the check below or run the domain health check. DNS changes usually appear within minutes, but can take up to a few hours. Official reference: Proton Mail documentation.
Check your Proton Mail setup
Or open the SPF checker, DKIM checker or DMARC checker directly.