Proton Mail SPF and DKIM setup

What you are setting up

Proton Mail hosts your mailboxes, so unlike a marketing ESP it needs your MX records as well as SPF and DKIM. You verify the domain with a TXT record, point MX at Proton, add the Proton SPF include, and publish three DKIM CNAME records. The CNAMEs are the part people misread: Proton does not hand you a key to paste, it delegates the selectors to itself and rotates the 2048-bit keys for you every six months.

Publish SPF and DKIM

In Proton Mail, go to Settings > Domain names and click Add domain. The wizard walks through tabs for verification, MX, SPF, DKIM, and DMARC, and each tab shows the exact value for your account. Start with the verification TXT at the root of the domain (@, or blank if your DNS host does not accept @), with the protonmail-verification= value Proton shows you. Once the domain verifies, publish the rest:

Type:  MX
Host:  @
Value: mail.protonmail.ch      (priority 10)
Value: mailsec.protonmail.ch   (priority 20)

Type:  TXT     (SPF)
Host:  @
Value: v=spf1 include:_spf.protonmail.ch ~all

Type:  CNAME   (DKIM, all three)
Host:  protonmail._domainkey
Host:  protonmail2._domainkey
Host:  protonmail3._domainkey
Value: the target Proton shows for each one (unique to your domain)

If you already have an SPF record, add include:_spf.protonmail.ch to the right of v=spf1 in the existing record rather than publishing a second one. Proton's default ends in ~all (soft fail), which is the safer choice until every sender on the domain is in the record. If other MX records exist, delete them or make sure mail.protonmail.ch has the lowest priority number, or inbound mail keeps landing at the old provider.

Add DMARC

Proton's DMARC tab suggests p=quarantine for most domains, and that is a fine destination. Start at p=none with a reporting address so you can see every source first, then ramp up:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Build it with our DMARC builder and progress past p=none once your reports are clean. Proton itself warns that a stricter policy can break mail that passes through forwarders and mailing lists that rewrite the message; the reports show you whether that applies to you.

The Proton Mail gotcha

Three CNAMEs, and no leftover TXT key. Proton needs all three protonmail._domainkey records so it can rotate signing keys without you touching DNS again. Adding only the first one works today and breaks at the next rotation. If your domain was set up under Proton's older manual method, with a DKIM TXT record at protonmail._domainkey, remove that TXT record before adding the CNAMEs; a name cannot carry both, and the stale key blocks rotation. Two smaller traps: some registrars reject a CNAME value with a trailing period while others require it, so if a record is refused, drop the final dot and retry; and on Cloudflare each CNAME must be DNS only, not proxied, or it never resolves.

Confirm it worked

• Check the domain status in Proton. Under Settings > Domain names, each tab should show its record as verified once DNS propagates.
• Send a test and read the headers. Send from a Proton address on the domain, open the message, and confirm the DKIM signature shows d=yourdomain.com with a protonmail selector and dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Proton Mail should appear as an aligned, passing source in your DMARC aggregate reports, labeled as a known sender in trustyourinbox.