Proton Mail (Proton Business): SPF, DKIM & DMARC Setup Guide
Proton Mail's encryption doesn't replace standard email authentication. For reliable delivery to Gmail, Outlook, and other providers, your custom domain still needs SPF, DKIM, and DMARC records.
1SPF Record Setup
Recommended SPF record for Proton Mail:
v=spf1 include:spf.protonmail.ch ~allProton Mail provides its SPF include for all outbound mail. If you only use Proton for your domain, this is the only include needed. Adding ~all is recommended over -all to allow forwarding.
Step-by-step setup:
- 1Log in to Proton Mail admin panel (account.proton.me)
- 2Go to Organization → Domains → your custom domain
- 3Proton shows all required DNS records including SPF
- 4Add TXT record: v=spf1 include:spf.protonmail.ch ~all
- 5Verify in Proton admin panel
- 6Check with our SPF checker
2DKIM Setup
Example DKIM record location:
protonmail._domainkey.yourdomain.comProton Mail provides three DKIM keys with different selectors (protonmail, protonmail2, protonmail3). All three should be published for key rotation support. These are TXT records, not CNAME.
Step-by-step setup:
- 1In Proton admin panel, go to Organization → Domains → your domain
- 2Find the DKIM section — Proton provides 3 TXT records
- 3Add all 3 TXT records to your DNS at the provided subdomains
- 4Verify in Proton panel after DNS propagation
- 5Test with our DKIM checker (look for protonmail, protonmail2, protonmail3 selectors)
3DMARC Policy
Recommended DMARC record:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100Add as a TXT record at: _dmarc.yourdomain.com
Proton Mail provides a DMARC record template in its admin panel. With SPF and DKIM both configured, your DMARC policy can be enforced. Proton sends email in a way that aligns with your domain.
Common Proton Mail Deliverability Issues
Proton emails going to spam at Gmail or Outlook
Verify all three DKIM records are published and that SPF passes. Check if your domain is on any blacklists. Proton Mail's shared IP infrastructure is generally clean, but domain reputation is separate.
Custom domain not working with Proton
Ensure you've added the MX records that point to Proton's servers in addition to SPF and DKIM. Proton requires specific MX, SPF, DKIM, and optionally DMARC records — all are shown in the admin panel.
DKIM check only finding one of three Proton selectors
Our DKIM checker tests common selectors including protonmail, protonmail2, and protonmail3. If only one is visible, verify the other two TXT records were published correctly.
Is Your Proton Mail Domain Blacklisted?
Authentication passing is necessary — but not sufficient. Check if your sending domain or IP is on any of 60 blacklists. Free, instant, no signup.
Check Your Domain FreeChecks all 60 blacklists + SPF, DKIM, DMARC, MX in under 10 seconds