SPF, DKIM and DMARC for Proton Mail

The DNS records Proton Mail needs so your mail is authenticated and stays out of spam.

SPF	TXT at `@`	v=spf1 include:_spf.protonmail.ch ~all Proton lists `v=spf1 include:_spf.protonmail.ch ~all`. Combine with your other senders →
DKIM	CNAME / TXT	Three CNAME records, `protonmail._domainkey`, `protonmail2._domainkey` and `protonmail3._domainkey`, pointing to the long `…domains.proton.ch` targets Proton shows.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read; build your own.

Step by step

In Proton go to Settings → Domain names, add your domain and publish the verification TXT record first.
Add the MX records Proton lists (mail.protonmail.ch and mailsec.protonmail.ch).
Add the SPF record below at @.
Copy the three DKIM CNAMEs from the DKIM tab: each target is unique to your domain.
Publish DMARC, then let Proton re-check the domain until every line is green.

The DKIM targets are per domain: copying them from another guide or domain will not work.
Custom domains need a paid Proton plan.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.