SPF, DKIM & DMARC for Proton Mail.

Why authenticate Proton Mail?

Authenticating your Proton domain decides whether your mail reaches the inbox at all — privacy is Proton's pitch, but privacy is not authentication, and receivers grade you on records, not intentions. Since February 2024, Gmail and Yahoo have required every bulk sender (roughly 5,000+ messages a day) to pass SPF, DKIM, and DMARC with alignment, and Microsoft began enforcing the same on high-volume mail to Outlook.com/Hotmail in 2025. Even for a low-volume personal or small-business mailbox, an unauthenticated Proton custom domain draws a \"via\" notice, fails DMARC, and drifts toward spam — and worse, it leaves your domain open to spoofing because you've published nothing that tells the world which servers may send as you. There is one Proton-specific reason this matters even more here: Proton owns and manages the SMTP return-path for your outbound mail and doesn't let you customize it, so SPF can't be relied on to align to your domain. That makes DKIM — which Proton signs as d=yourdomain.com — the mechanism that actually carries your DMARC pass. Set up all three and your mail is cryptographically yours, the \"via\" tag disappears, DMARC passes on aligned DKIM, and the reputation you build accrues to your own domain.

The SPF reality for Proton Mail

Proton Mail is a genuine \"include\" provider: you add one shared mechanism, include:_spf.protonmail.ch, to the single SPF TXT record on your root domain — the full record is v=spf1 include:_spf.protonmail.ch ~all. This is a real shared include (every Proton custom-domain customer uses the same one), unlike CNAME-delegation ESPs. It costs just one DNS lookup toward the RFC 7208 limit of 10, and Proton explicitly recommends ending with ~all (softfail) rather than -all, so mail from a server you forgot to list is marked suspicious rather than hard-rejected. There is an important Proton-specific caveat, though: because Proton controls the envelope sender / Return-Path on your outbound mail and gives you no way to point it at your own domain (no em-style sending subdomain like SendGrid, no custom Return-Path), you should NOT count on SPF aligning to your domain for DMARC. Treat include:_spf.protonmail.ch as doing two useful jobs — authorizing Proton's outbound IPs and satisfying the raw SPF check — and lean on DKIM as your aligned mechanism, since Proton signs every message with d=yourdomain.com. Keep exactly one SPF TXT record on the domain: if you also send through Google Workspace, Microsoft 365, or a newsletter tool, merge every mechanism into that single v=spf1 line rather than publishing a second SPF record (two SPF records is itself a PermError). And each sending subdomain needs its own SPF — the record on yourdomain.com does not cover mail.yourdomain.com.

Step by step

Records to add

Proton Mail generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.

The 10-lookup budget

SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what Proton Mail's setup costs against that budget.

Check it actually worked

Don't trust the tabs' green ticks alone — they only confirm the records resolve, not that your mail authenticates end-to-end. Send a real test from your custom-domain address to a Gmail account, open it, and choose ⋮ → Show original. You want DKIM: PASS with signed-by / d=yourdomain.com (the active selector will be one of protonmail, protonmail2, or protonmail3, depending on where rotation currently sits) and DMARC: PASS. SPF will usually show a pass too, but note whether it's aligned to your domain or to Proton's return-path — if only DKIM aligns, that's expected on Proton and DMARC still passes on DKIM. A quick second opinion: send a message to a Mail-Tester address, which should score 10/10 with SPF and DKIM both green. You can spot-check the raw records with dig CNAME protonmail._domainkey.yourdomain.com, dig TXT yourdomain.com, and dig TXT _dmarc.yourdomain.com. Finally, run the domain through Qualisend's domain health check to confirm the SPF include, all three DKIM CNAMEs, and the DMARC record resolve cleanly and your SPF stays under the 10-lookup limit — and once aggregate reports start arriving, drop one into the DMARC report analyzer to confirm Proton shows up as an aligned, passing source.

Common gotchas

• Coverage

  Custom domains require a paid Proton Mail plan (Mail Plus, Proton Unlimited, Proton Family/Duo, or Proton for Business). You can't add or authenticate a domain on a free account — this is the first thing to check if the Domain names section won't let you proceed.

• DNS setup

  Don't rely on SPF for DMARC on Proton. Proton controls the outbound return-path and gives you no way to customize it, so SPF may not align to your domain. DKIM — signed as d=yourdomain.com via the three CNAMEs — is the mechanism that carries your DMARC pass. Never skip DKIM.

• DNS setup

  All three DKIM CNAMEs are required. Proton rotates 2048-bit keys across the protonmail, protonmail2, and protonmail3 selectors; publish only one and rotation eventually leaves outgoing mail signed by a key your DNS doesn't advertise, so DKIM silently starts failing weeks later.

• DNS setup

  The DKIM CNAME value must be an exact match. Many registrars append a trailing period or auto-add your domain, turning the target into something Proton's checker rejects — trim it so it matches the wizard exactly, or the green tick never appears.

• DNS setup

  Migrating from the old TXT-based DKIM? Delete the legacy protonmail._domainkey TXT record before adding the CNAMEs. A stale TXT and the new CNAME on the same host conflict and DKIM won't validate.

• DNS setup

  On Cloudflare, set every DKIM CNAME to DNS only (grey cloud). An orange-cloud proxied CNAME won't resolve to *.domains.proton.ch and verification fails — a very common Proton-on-Cloudflare gotcha.

• Breaks auth

  Keep exactly one SPF TXT record. If you also send via Google Workspace, Microsoft 365, or a newsletter tool, merge include:_spf.protonmail.ch into the single v=spf1 line — two SPF records is a PermError. And each sending subdomain needs its own SPF, DKIM, and DMARC.

Build your SPF record

Proton Mail is pre-selected below. Add any other platforms you send through, then publish the single merged record.

Proton Mail SPF — FAQ

Related reading

Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.