Proton Mail Email Authentication Setup

Encrypted email service with custom domain support for businesses. This guide covers the complete email authentication stack for Proton Mail: SPF, DKIM, and DMARC. Each section gives you the exact DNS records, step-by-step instructions, common pitfalls, and how to verify your setup.

Jump to a Protocol

SPF

Authorize which servers can send email for your domain.

DKIM

Cryptographically sign your outgoing email so receivers can verify it.

DMARC

Tell receivers what to do when SPF or DKIM fail.

SPFTest with our SPF Checker →

How to Set Up SPF for Proton Mail

Authorize Proton Mail to send email on behalf of your custom domain by adding the correct SPF include.

Quick Answer — The Record You Need

Type

TXT

Host / Name

Value

v=spf1 include:_spf.protonmail.ch ~all

Proton Mail uses a .ch domain (Switzerland) for its SPF include.

Step-by-Step Setup

Log in to Proton Mail

Go to mail.proton.me and sign in with your Proton account (paid plan required for custom domains).

Navigate to custom domain settings

Go to Settings > All settings > Proton Mail > Domain names. Add your custom domain if not already added.

View the SPF record

Proton Mail displays the SPF record as part of the domain setup wizard.

Add the SPF record to DNS

Add the SPF TXT record to your DNS.

v=spf1 include:_spf.protonmail.ch ~all

Verify in Proton Mail

Click "Verify" in Proton Mail settings. The platform will check your DNS records.

Before & After

Before

v=spf1 ~all

After

v=spf1 include:_spf.protonmail.ch ~all

SPF Gotchas

Proton Mail uses _spf.protonmail.ch (Swiss domain), not protonmail.com or proton.me.
Custom domains require a paid Proton Mail plan (Mail Plus or higher).
If you also use Proton for calendar invites, they use the same sending infrastructure, so the SPF include covers both.

SPF FAQ

What SPF record do I need for Proton Mail?

Add include:_spf.protonmail.ch to your SPF record. Note the .ch domain extension (Switzerland).

Why does Proton Mail use a .ch domain for SPF?

Proton Mail is a Swiss company (Proton AG) headquartered in Geneva. Their infrastructure uses the .ch (Switzerland) domain.

Do I need a paid plan for Proton Mail custom domains?

Yes. Custom domain support requires Proton Mail Plus or higher.

DKIMTest with our DKIM Checker →

How to Set Up DKIM for Proton Mail

Enable DKIM for Proton Mail by publishing three CNAME records for the protonmail, protonmail2, and protonmail3 selectors.

Quick Answer — The Record You Need

Type

CNAME

Host / Name

protonmail._domainkey

Value

protonmail.domainkey.dxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.domains.proton.ch

Proton Mail provides three CNAME records with selectors protonmail, protonmail2, and protonmail3. Values are unique to your domain.

Step-by-Step Setup

Log in to Proton Mail

Go to mail.proton.me and sign in.

Navigate to domain settings

Go to Settings > All settings > Proton Mail > Domain names. Select your domain.

View DKIM records

Proton Mail displays three CNAME records for DKIM in the domain setup wizard.

Add all three CNAME records

Create the three CNAME records in your DNS provider.

protonmail._domainkey.yourdomain.com   CNAME  protonmail.domainkey.dxxx...domains.proton.ch
protonmail2._domainkey.yourdomain.com  CNAME  protonmail2.domainkey.dxxx...domains.proton.ch
protonmail3._domainkey.yourdomain.com  CNAME  protonmail3.domainkey.dxxx...domains.proton.ch

Verify in Proton Mail

Click "Verify" in Proton Mail. The platform checks all three CNAME records.

DKIM Gotchas

Proton Mail requires three CNAME records (protonmail, protonmail2, protonmail3). All three are needed for key rotation.
The CNAME values contain a unique identifier for your domain. Copy them exactly from Proton Mail settings.
CNAME target domains point to domains.proton.ch. This is the correct Proton infrastructure domain.

DKIM FAQ

What DKIM selectors does Proton Mail use?

Proton Mail uses protonmail, protonmail2, and protonmail3 as DKIM selectors. All three are published as CNAME records.

Why does Proton Mail need three DKIM records?

Three selectors enable seamless DKIM key rotation. Proton can rotate keys without any downtime or DNS changes needed from you.

Does Proton Mail rotate DKIM keys automatically?

Yes. The CNAME-based setup allows Proton to manage key rotation on their infrastructure.

DMARCTest with our DMARC Checker →

How to Set Up DMARC for Proton Mail

Publish a DMARC record to protect your custom domain when using Proton Mail.

Quick Answer — The Record You Need

Type

TXT

Host / Name

_dmarc

Value

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Proton Mail includes a DMARC record suggestion in the domain setup wizard.

Step-by-Step Setup

Configure SPF and DKIM

Set up SPF (include:_spf.protonmail.ch) and DKIM (3 CNAME records) for Proton Mail first.

View Proton's DMARC suggestion

Proton Mail suggests a DMARC record during domain setup. You can customize it.

Create the DMARC record

Add a TXT record at _dmarc.yourdomain.com.

v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1

Monitor reports

Review DMARC aggregate reports. Proton Mail typically aligns well.

Enforce the policy

After confirming clean reports, move to p=quarantine and then p=reject.

DMARC Gotchas

Proton Mail provides excellent SPF and DKIM alignment for custom domains.
If Proton Mail is your only email sender, you can move to p=reject relatively quickly.
Proton Mail suggests a DMARC record in their domain setup wizard. Use it as a starting point and customize the reporting address.

DMARC FAQ

Does Proton Mail support DMARC?

Yes. Proton Mail provides SPF and DKIM alignment and includes a DMARC record suggestion in the domain setup wizard.

Can I use p=reject with Proton Mail?

Yes. Proton Mail has strong authentication support. If it is your only email sender, p=reject is safe to use.

Does Proton Mail help me set up DMARC?

Yes. The domain setup wizard includes a step for DMARC and provides a suggested record value.

Verify Your Proton Mail Setup

Once your SPF, DKIM, and DMARC records are in place, run a full domain scan to confirm everything is configured correctly. DNS changes typically propagate within minutes but can take up to 48 hours.

Setup Guides for Other Providers

Google Workspace Microsoft 365 SendGrid Mailchimp Mailgun Amazon SES Postmark HubSpot Zendesk Zoho Mail Salesforce Brevo All Guides →