Guides › Providers
SPF, DKIM and DMARC for Proton Mail
SPF
Host: @ Type: TXT Value: v=spf1 include:_spf.protonmail.ch ~all
If you already have an SPF record, add the include to it rather than creating a second record. Two SPF records make SPF fail (see merging SPF records).
DKIM
Proton uses three CNAMEs, protonmail._domainkey, protonmail2._domainkey and protonmail3._domainkey, that point to domain-specific targets. Copy the exact values from Settings › Domain names › Review › DKIM.
DMARC
DMARC is set once per domain, not per provider. If you don't have one, start in monitoring mode:
Host: _dmarc Type: TXT Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Once the reports show all your legitimate mail passing, move to p=quarantine and then p=reject. See the rollout guide.
Notes
Proton also asks for a protonmail-verification=… TXT record to prove ownership. That's separate from SPF, so don't merge them.
Use the checker to confirm all three records. It detects Proton Mail's DKIM selector automatically if it's a standard one.