This guide shows the DNS records Proton Mail needs so your email is authenticated: SPF, DKIM and DMARC. Use the exact values from your Proton Mail account where they differ — providers update them from time to time.
1. SPF record for Proton Mail
Add Proton Mail to your domain's SPF record. If you have no SPF record yet, create this TXT record on the root of your domain (host @):
v=spf1 include:_spf.protonmail.ch ~all
Already have an SPF record? Do not add a second one — insert include:_spf.protonmail.ch before the ~all / -all at the end of your existing record.
Use the SPF Generator to combine several services and the SPF Checker to confirm you stay under 10 DNS lookups.
2. DKIM for Proton Mail
In Proton Mail, follow this path and publish the record it shows:
- Proton settings → Domain names → your domain → DKIM
- Add the three CNAME records shown.
- Give DNS a few minutes, then confirm the record with the DKIM Checker.
The DKIM selector is usually protonmail, so the record lives at protonmail._domainkey.yourdomain.com. Enter that selector in the DKIM Checker to verify it.
3. DMARC
After SPF and DKIM pass, add a DMARC record so receivers know your policy and send you reports. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Then follow the step-by-step DMARC rollout to reach quarantine and reject safely.
4. MX records
To receive email with Proton Mail, your MX records must point to Proton Mail's servers (host names containing protonmail.ch, proton.me). Copy the exact values from your Proton Mail admin panel and check them with the MX Lookup.
Where to add the records
- Cloudflare — Cloudflare dashboard → select your domain → DNS → Records → Add record. For mail records keep the proxy (orange cloud) OFF.
- GoDaddy — GoDaddy → My Products → your domain → DNS → Manage DNS → Add New Record.
- Namecheap — Namecheap → Domain List → Manage → Advanced DNS → Add New Record. Use "@" for the root domain.
- Hostinger — Hostinger hPanel → Domains → your domain → DNS / Nameservers → Manage DNS records.
- Amazon Route 53 — AWS console → Route 53 → Hosted zones → your domain → Create record. Wrap TXT values in quotes.
Frequently asked questions
Do I need SPF, DKIM and DMARC for Proton Mail?
Yes. Gmail and Yahoo require SPF and DKIM plus DMARC for bulk senders, and authenticated mail is far less likely to land in spam.
Can I have two SPF records?
No. Two SPF records make SPF fail. Combine all services into one record.
How do I check that Proton Mail authentication works?
Run the Domain Checker, or send a message to Gmail and use "Show original" to see SPF, DKIM and DMARC results.
What is the DKIM selector for Proton Mail?
Usually "protonmail" — but use the selector shown in your Proton Mail admin panel if it differs.