Proton MailSPF, DKIM & DMARC Setup
Proton Mail custom domains use three DKIM CNAMEs (for automatic key rotation) and two MX hosts. Proton's setup wizard checks each record live as you add it.
Already set up? Check what your domain publishes right now — SPF, DKIM (protonmail, protonmail2, protonmail3), DMARC, MX, BIMI, and MTA-STS in one scan.
Run a free domain check →1. SPF record
Publish as a TXT record on your root domain. One SPF record per domain — merge includes if you use other senders.
TXT record
v=spf1 include:_spf.protonmail.ch ~all2. DKIM (selectors: protonmail, protonmail2, protonmail3)
Settings → Domain names → your domain → DKIM: Proton shows three CNAME records (protonmail._domainkey, protonmail2._domainkey, protonmail3._domainkey pointing at *.domains.proton.ch). All three must be published — Proton rotates keys between them.
3. MX records
| Host | Priority |
|---|---|
| mail.protonmail.ch | 10 |
| mailsec.protonmail.ch | 20 |
Verify with the MX Record Lookup tool.
4. DMARC record
Proton's wizard suggests a DMARC record during setup. Start at p=none, review reports, then tighten. Proton signs all outbound mail once the CNAMEs verify.
TXT record at _dmarc.yourdomain.com
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comProton Mail authentication FAQ
Why does Proton need three DKIM CNAMEs?
Key rotation. Proton alternates signing between the three selectors so it can retire a key without any DNS change on your side. If one CNAME is missing, rotation eventually breaks signing.
My DKIM shows 'CNAME not found' but I added TXT records — what's wrong?
Proton uses CNAME records for DKIM, not TXT. Delete the TXT attempts and add the three CNAMEs exactly as shown in the domain settings screen.
Official documentation: Proton Mail email authentication docs ↗
Verify your setup
DNS Email Diagnostics
SPF, DKIM, DMARC, MX, BIMI & MTA-STS in one check
MX Record Lookup
See exactly which mail servers your domain publishes
BIMI Validator
Show your logo in Gmail & Yahoo once DMARC is enforced
Deliverability Monitoring
Daily checks + email alerts when a record changes or breaks