Proton Mail: DKIM and SPF setup

Before you start

Proton supports custom domains on all paid plans. You set them up from your organization's administrator account.

This guide assumes example.com is already added and verified in Proton. If it is not, Proton's custom domain guide walks you through that first. You also need access to the DNS settings of example.com.

Turn on DKIM

Proton uses three CNAME records, named protonmail._domainkey, protonmail2._domainkey and protonmail3._domainkey. The values are specific to your domain, so copy them from Proton.

1. In Proton Mail, go to Settings > All settings > Organization > Domain names. The direct link is https://account.proton.me/mail/domain-names.
2. In the Actions column, click Review next to example.com.
3. Select the DKIM tab. It shows three host names and values.
4. At your DNS host, create the three CNAME records exactly as Proton shows them. Some DNS hosts refuse a value that ends in a dot. If yours does, remove the dot at the end of each value.

When Proton finds the records, the DKIM tab shows a green tick. Proton then notifies you and starts signing mail from example.com. Proton says verification can take a few hours.

Proton generates a new 2048-bit key every six months. The CNAME records let it do that without any change on your side.

Sign with your own domain

Reports show mail from Proton Mail that is DKIM-signed by a domain other than example.com. DMARC counts DKIM only when the signing domain is example.com or a subdomain of it. Publish the three records for example.com, as in Turn on DKIM.

Check the DKIM key

If example.com used Proton's older manual key rotation, it has a DKIM TXT record. Proton asks you to delete that TXT record before you add the CNAME records. DKIM stops signing your mail when you delete it, so add the three CNAME records straight away.

The CNAME records must match the values on the DKIM tab exactly.

SPF

Proton documents include:_spf.protonmail.ch. The SPF tab of the same Review screen shows the record Proton recommends for example.com.

A domain may have only one SPF record. If example.com has one already, add include:_spf.protonmail.ch to it, after v=spf1. Proton explains the endings this way: ~all marks failing mail, and -all has it rejected. Proton notes that SPF often fails for forwarded mail. When Proton finds the include, the SPF tab shows a green tick.

Check it worked

1. On the Review screen for example.com, the DKIM and SPF tabs show a green tick.
2. Most mailbox providers send one report a day. Reports from the next 24 to 48 hours show whether DKIM aligns for Proton Mail. The DKIM table on Mailmoni's DNS tab lists the protonmail selectors once a report includes them.

Proton's pages: Anti-spoofing for custom domains and Custom domain setup.