Your own domain at Proton Mail: SPF, DKIM and DMARC step by step
Proton Mail with a custom domain: the wizard under Settings → Domain names, the five steps (verify, addresses, MX, SPF, DKIM/DMARC), the SPF include _spf.protonmail.ch, the three DKIM CNAMEs and Proton's DMARC recommendation — proven in our own operation.
At Proton Mail a wizard guides you through your own domain: in Settings → All settings → Domain names → "Add domain". It asks for verification, addresses, MX, SPF, DKIM and DMARC one after the other and shows the exact DNS records for each step, which you create at your domain's DNS provider (e.g. World4You). Later you reach the same values via the "Review" button next to the domain, with one tab each for SPF, DKIM and DMARC. We run this setup for mailampel.com ourselves — the values below are verified on our own domain.
Step 1: Add and verify the domain
- Settings → All settings → Domain names → "Add domain", enter the domain name.
- Verify: create the TXT record shown (protonmail-verification=…) on the domain and have the wizard check it.
- Create addresses: assign at least one address with the new domain to a user.
- MX: set the two MX records from the wizard — Proton's records must have the lowest priority numbers; remove old MX records of the previous provider.
Step 2: SPF
Proton requires the include to go into a single SPF record — "make sure you have only one SPF record". For Proton-only sending:
your-domain.comv=spf1 include:_spf.protonmail.ch ~allStep 3: DKIM — three CNAME records
Proton uses three selectors at the same time so keys can rotate in the background without ever sending an unsigned email. Proton says it explicitly: add all three DKIM records. The targets contain a domain-specific code — copy from the wizard, never retype:
protonmail._domainkey.your-domain.comprotonmail.domainkey.<your-code>.domains.proton.chprotonmail2._domainkey.your-domain.comprotonmail2.domainkey.<your-code>.domains.proton.chprotonmail3._domainkey.your-domain.comprotonmail3.domainkey.<your-code>.domains.proton.chStep 4: DMARC
Proton recommends p=quarantine as the starting point for most domains and p=reject later. If you still have other sending services or want to see reports first, start with p=none as in the step-by-step plan and tighten afterwards — both work fine with Proton:
_dmarc.your-domain.comv=DMARC1; p=quarantine; rua=mailto:dmarc@your-domain.comStep 5: Wait and check
Proton quotes minutes to hours until the records take effect, depending on the previous TTL; some recipients keep old values for up to one to three days. Then check the domain from the outside — Proton's ticks only see its own records, not a previous provider's duplicate SPF or forgotten sending services — and send a test email to a Gmail mailbox: "Show original" must show spf=pass, dkim=pass, dmarc=pass.
Frequently asked questions
How do I connect my own domain to Proton Mail?
In Proton under Settings → All settings → Domain names → "Add domain". The wizard shows verification, MX, SPF, DKIM and DMARC records one after the other, which you create at the domain's DNS provider; a custom domain requires a paid Proton plan.
The wizard shows everything green — am I done?
Almost. Proton's ticks check its own records. What the wizard does not see: duplicate SPF records from a previous provider, or forgotten sending services (newsletter, shop) that additionally belong in SPF and need their own DKIM. An independent check covers that too.
Why three DKIM selectors instead of one?
For automatic key rotation: Proton can arm a new key on the next selector while the old one is still valid. For you that means: set three CNAMEs once, never touch them again.
Should I set p=quarantine right away, as Proton suggests?
If Proton is your only sending path and SPF plus DKIM are green: yes, that is safe. If other services still send with your domain, first check with p=none and reports whether they all pass — otherwise their mail lands in spam.