Understanding Proton Mail (Custom Domains) Email Authentication
Proton Mail allows users to link custom domains with end-to-end encryption. Proton provides 3 CNAME DKIM records for zero-downtime rotation.
When Proton Mail (Custom Domains) delivers outbound emails on your behalf, recipient mail transfer agents (MTAs) at Google, Yahoo, Microsoft, and corporate mail gateways inspect the sender identity. Without a published SPF record explicitly permitting Proton Mail (Custom Domains)'s IP ranges, these emails trigger SPF Softfail (~all) or Hardfail (-all), severely degrading domain reputation and inbox placement.
Required DNS Records for Proton Mail
Publish the following DNS records in your domain registrar or DNS management console (Cloudflare, AWS Route 53, GoDaddy, Namecheap):
| Type | Host / Name | Value / Target | TTL | Purpose |
|---|---|---|---|---|
| TXT | @ | v=spf1 include:_spf.protonmail.ch ~all | 3600 | Proton Mail SPF. |
| MX | @ | mail.protonmail.ch | 3600 | Primary Proton Mail MX. |
Step-by-Step Setup Instructions
In Proton Mail > Settings > Domain names > Add domain.
Add the TXT verification record to verify domain ownership.
Add MX records: mail.protonmail.ch and mailsec.protonmail.ch.
Add SPF TXT record: "v=spf1 include:_spf.protonmail.ch ~all".
Add the 3 DKIM CNAME records (protonmail, protonmail2, protonmail3).
Common Proton Mail SPF Configuration Mistakes
× Proton Verification Token Missing
Cause: Skipping proton-verification TXT.
Fix: Add verification TXT.
Frequently Asked Questions
What is the SPF include for Proton Mail?
Use "include:_spf.protonmail.ch".