Proton Mail Custom Domain: SPF, DKIM and DMARC Setup

If you use a custom domain with Proton Mail, SPF, DKIM and DMARC are what stop someone forging mail that looks like it came from your address. For privacy-minded Proton users this is less about sending volume and more about protecting your own name from being spoofed.

The good news: Proton generates most of the records for you, and once the DNS is correct it signs your outgoing mail automatically. This guide gives you the exact records, in order, and what to do when one of them will not verify.

The short answer#

You add all three records in your domain registrar's DNS after adding the domain in Proton. Each one does a different job, and mailbox providers check them together.

• SPF tells receivers which servers may send for your domain — for Proton, that is include:_spf.protonmail.ch.
• DKIM adds a cryptographic signature that Proton generates, hosts and rotates for you through three CNAME records.
• DMARC tells receivers what to do with mail that fails both checks, and asks them to send you reports.
• A verification TXT record proves to Proton that you own the domain before any of this turns on.

Before you start#

Two things have to be true before the anti-spoofing records will work.

First, custom domains need a paid Proton Mail plan (Mail Plus and above); the free plan does not support them. Plan details change, so confirm current packaging on Proton's own pricing page (as of August 2026).

Second, you need access to your domain's DNS — the registrar or DNS host where the domain lives — because every record here is added there, not inside Proton. Add and verify the domain in Proton first, then add Proton's MX records so mail is actually delivered before you worry about signing it. DNS changes are not instant: most propagate within minutes, but they can take up to 48 hours.

• A paid Proton Mail plan with custom-domain support (as of August 2026).
• The domain added in Proton under Settings, then Domain names.
• Your registrar's DNS console open in another tab.
• Proton's two MX records added first — copy them exactly from the setup screen.

Set up SPF, DKIM and DMARC step by step#

1. 1

   Verify the domain

   In Proton, open Settings then Domain names and add your domain. Proton gives you a TXT record: host @ (the root of your domain), value protonmail-verification=xxx, where xxx is your unique code. Add it at your registrar and click Verify. Nothing else activates until this passes.

2. 2

   Add the SPF record

   Publish one TXT record on the root (@) with the value v=spf1 include:_spf.protonmail.ch ~all. The include authorises Proton's servers; ~all soft-fails everything else, which is safer than -all while you confirm nothing legitimate breaks. If you already have an SPF record, merge this include into it — never publish a second SPF record.

3. 3

   Add the three DKIM CNAMEs

   Proton's wizard generates three CNAME records unique to your domain. Copy each host name and target exactly as shown; a single typo stops signing. You never paste a public key into a TXT record yourself — the keys stay with Proton, which rotates a fresh 2048-bit key every six months. Once all three CNAMEs resolve, Proton starts signing your outgoing mail automatically.

4. 4

   Publish the DMARC policy

   Add a TXT record on the host _dmarc with a value such as v=DMARC1; p=quarantine; rua=mailto:[email protected]. Proton recommends p=quarantine, which asks receivers to spam-folder unauthenticated mail. The rua address is where aggregate reports are sent, so you can see who is sending as your domain.

5. 5

   Confirm it is working

   Back in Proton, each record should show a verified state. Send yourself a message from the domain and check the headers for spf=pass, dkim=pass and dmarc=pass. If any is missing, the troubleshooting section below points you to the record to fix.

The four DNS records at a glance#

What these records actually stop#

Without authentication, anyone can put your domain in the From line and mailbox providers have no reliable way to tell the forgery from you. That is the whole risk for a personal or business domain: your name gets used to phish the people who trust it.

With SPF, DKIM and DMARC in place, a receiver can check that the mail really came through Proton and that the signature matches your domain. Your DMARC policy then tells it to quarantine or reject anything that fails, which is what turns authentication from a passive record into active protection.

Where you add the records: registrar differences#

The records are the same everywhere; only the field labels differ between DNS hosts. Two things trip people up most: how to enter the root (@), and, on proxying hosts, leaving DKIM CNAMEs un-proxied so they resolve.

Why DMARC needs alignment (and why Proton passes it)#

DMARC does more than run SPF and DKIM — it checks alignment. A message passes DMARC when SPF or DKIM verifies and the verified domain matches the domain in the visible From address. A message can pass SPF for a completely different domain and still be a spoof of yours, so alignment is the part that matters.

With Proton, DKIM signs as your own domain, so a correctly signed message aligns and passes DMARC. Keep DKIM healthy and alignment takes care of itself. This is also why a broken DKIM CNAME can make DMARC start failing even when SPF still looks fine.

What to do when it doesn't work#

Most failures come down to one wrong field. Work through them by symptom rather than re-adding everything.

• Domain will not verify: the TXT is on the wrong host. It must be on @ (the root), not on www or a subdomain. Give it time to propagate before retrying.
• DKIM will not sign: one of the three CNAMEs does not match exactly, or it is proxied on Cloudflare. Re-copy each host and target from Proton and set them to DNS only.
• SPF permerror or too many lookups: SPF fails once it needs more than ten DNS lookups. Trim unused includes, and confirm you have exactly one SPF record.
• DMARC has no effect: it needs alignment and an enforcing policy. Keep DKIM working, and start at p=none to read reports before you move to quarantine or reject.

A note on the DMARC standard#

If an older guide tells you to add a pct tag to your DMARC record, ignore it.

A faster way to run a Proton inbox#

Authentication is a one-time job at your registrar, and nothing automates it for you — publishing SPF, DKIM and DMARC is between you and your DNS host. AI Emaily does not set those records up, and it is not a DMARC monitoring service. The records above are yours to add, and this page exists to get them right whether or not you ever sign up.

What AI Emaily does is the part that never ends. Once your Proton domain is authenticated and mail is flowing, you can connect that mailbox — Proton exposes it through Proton Bridge — and let AI Emaily triage it, draft replies in a voice you set, and file threads, with approve-before-send and an undo on every action. It does not train on your mail. We build AI Emaily; that is the product this site sells, and this is the honest scope of where it fits.