Skip to content
iBlockSpam
Get started
Check your domain Get started Log in
How it works
Platforms
Microsoft 365 Google Workspace cPanel / WHM Exchange Server
Solutions
Small business MSPs Hosting providers Law firms Accounting firms Healthcare practices Real estate & title
Free tools Pricing
Blog
All guides
By topic
Email security basics Phishing & threats SPF, DKIM & DMARC Setup guides Running email day to day Switching & migration Choosing a filter
Reference
Glossary Research: top 1,000 sites
DKIM by provider

DKIM record for Proton Mail

Proton Mail signs mail from a custom domain through three CNAME records, protonmail._domainkey, protonmail2._domainkey and protonmail3._domainkey. Proton generates a new 2048-bit key every six months and keeps three names so one key is always active while the others are retired and recreated. Custom domains need a paid plan.

Record type
CNAME
Selectors
protonmail, protonmail2, protonmail3
Private key held by
Provider (CNAME delegation)

The DNS records

The targets are unique to your domain: copy them from the DKIM tab in Proton's domain settings.

Selector protonmail

Type: CNAME · Host: protonmail._domainkey 

<target 1 from the DKIM tab>

Selector protonmail2

Type: CNAME · Host: protonmail2._domainkey 

<target 2 from the DKIM tab>

Selector protonmail3

Type: CNAME · Host: protonmail3._domainkey 

<target 3 from the DKIM tab>

One of Proton's registrar guides prints the names as protonmail._domainkey1 and protonmail._domainkey2. That is a typo: the number belongs to the selector, as above.

Set it up and turn on signing

  1. Add and verify your domain first. Proton generates the DKIM records after verification and emails you when they're ready; verification can take a couple of hours.
  2. Go to Settings > All settings > Organization > Domain names, click Review next to the domain, and open the DKIM tab.
  3. Create the three CNAMEs at your DNS host. Proton's registrar guides suggest a low TTL so changes are picked up quickly.
  4. Wait for the DKIM tab to show a green tick. Proton then starts signing your domain's mail.

DMARC alignment

Once the tab shows a green tick, Proton says it signs outgoing mail from your custom domain with DKIM just as it does for its own addresses. The signing domain is then yours, so DKIM can carry DMARC when forwarding breaks SPF.

Key length and rotation

Proton documents its schedule: a new 2048-bit key every six months, used to sign your mail. That is why it asks for three CNAMEs and asks you to keep them: one key signs while the others are retired and recreated. Domains set up in the era of manual rotation may still have a DKIM TXT record. Proton warns that DKIM stops signing as soon as you delete that TXT record, so add the CNAMEs straight away.

Common mistakes

  • A trailing period the registrar rejects (or requires). Proton notes registrars differ; if the value is refused, remove the final dot.
  • Cloudflare proxying. Choose DNS only in the Proxy status menu, or the record won't propagate.
  • Deleting an old TXT key and stopping there. Signing stops until the three CNAMEs exist.
  • Copying the typo'd names from the registrar guide instead of the DKIM tab.

Check your Proton Mail DKIM key

The selector is filled in for you; add your domain. Free, reads public DNS only.

Frequently asked questions

Why does Proton Mail need three DKIM records?

Proton rotates keys automatically. Three CNAMEs let one key stay active while the other two are retired and recreated, so signing never stops. Keep all three in DNS permanently.

Can I use DKIM with a free Proton Mail account?

Custom domains need a paid Proton plan, and DKIM for your domain comes with the custom domain. On a free plan you send from a Proton address, which Proton already signs.

How do I move from a Proton DKIM TXT record to CNAMEs?

Copy the three CNAME values from the DKIM tab first. Proton says signing stops as soon as you delete the old TXT record, so delete it and add the CNAMEs in one sitting.

Sources

Checked against Proton Mail's documentation on October 9, 2026. Providers change their setup screens; if yours differs, follow the values your admin console shows.

DKIM records for other providers

Compare every provider's selectors in one table · SPF record for Proton Mail

Related guides

SPF, DKIM & DMARC

How to find a domain's DKIM selector, and check its key

Find a DKIM selector from the s= tag in an email header, see the selectors Microsoft 365, Google Workspace and common senders use, then check the key.

8 min read SPF, DKIM & DMARC

How to rotate DKIM keys without breaking email

How often to rotate DKIM keys, which key length to use, how to name selectors, and how to rotate in Microsoft 365, Google Workspace and on your own server.

9 min read SPF, DKIM & DMARC

DKIM "body hash did not verify" and other DKIM failures: causes and fixes

Fix DKIM failures: body hash did not verify, signature did not verify, no key for signature and short keys. Causes from mailing lists to broken TXT records.

9 min read

Last updated