# DKIM record for Proton Mail

URL: https://iblockspam.com/dkim/proton-mail
Last updated: 2026-10-09

Record type: CNAME
Selectors: protonmail, protonmail2, protonmail3
Key managed by: Provider (CNAME delegation)

Proton Mail signs mail from a custom domain through three CNAME records, `protonmail._domainkey`, `protonmail2._domainkey` and `protonmail3._domainkey`. Proton generates a new 2048-bit key every six months and keeps three names so one key is always active while the others are retired and recreated. Custom domains need a paid plan.

## DNS records

- Selector protonmail (CNAME, host protonmail._domainkey): `<target 1 from the DKIM tab>`
- Selector protonmail2 (CNAME, host protonmail2._domainkey): `<target 2 from the DKIM tab>`
- Selector protonmail3 (CNAME, host protonmail3._domainkey): `<target 3 from the DKIM tab>` One of Proton's registrar guides prints the names as `protonmail._domainkey1` and `protonmail._domainkey2`. That is a typo: the number belongs to the selector, as above.

## Set it up and turn on signing

- Add and verify your domain first. Proton generates the DKIM records after verification and emails you when they're ready; verification can take a couple of hours.
- Go to **Settings > All settings > Organization > Domain names**, click **Review** next to the domain, and open the **DKIM** tab.
- Create the three CNAMEs at your DNS host. Proton's registrar guides suggest a low TTL so changes are picked up quickly.
- Wait for the DKIM tab to show a green tick. Proton then starts signing your domain's mail.

## DMARC alignment

Once the tab shows a green tick, Proton says it signs outgoing mail from your custom domain with DKIM just as it does for its own addresses. The signing domain is then yours, so DKIM can carry DMARC when forwarding breaks SPF.

## Key length and rotation

Proton documents its schedule: a new 2048-bit key every six months, used to sign your mail. That is why it asks for three CNAMEs and asks you to keep them: one key signs while the others are retired and recreated. Domains set up in the era of manual rotation may still have a DKIM TXT record. Proton warns that DKIM stops signing as soon as you delete that TXT record, so add the CNAMEs straight away.

## Common mistakes

- **A trailing period the registrar rejects (or requires).** Proton notes registrars differ; if the value is refused, remove the final dot.
- **Cloudflare proxying.** Choose DNS only in the Proxy status menu, or the record won't propagate.
- **Deleting an old TXT key and stopping there.** Signing stops until the three CNAMEs exist.
- **Copying the typo'd names** from the registrar guide instead of the DKIM tab.

**Q: Why does Proton Mail need three DKIM records?**
Proton rotates keys automatically. Three CNAMEs let one key stay active while the other two are retired and recreated, so signing never stops. Keep all three in DNS permanently.

**Q: Can I use DKIM with a free Proton Mail account?**
Custom domains need a paid Proton plan, and DKIM for your domain comes with the custom domain. On a free plan you send from a Proton address, which Proton already signs.

**Q: How do I move from a Proton DKIM TXT record to CNAMEs?**
Copy the three CNAME values from the DKIM tab first. Proton says signing stops as soon as you delete the old TXT record, so delete it and add the CNAMEs in one sitting.

Sources:
- Proton Support: Anti-spoofing for custom domains (SPF, DKIM and DMARC): https://proton.me/support/anti-spoofing-custom-domain
- Proton Support: Problems with configuring CNAME records: https://proton.me/support/cname-problems
- Proton Support: How to set up a custom domain with Cloudflare: https://proton.me/support/custom-domain-cloudflare

---

Source: iBlockSpam, https://iblockspam.com/dkim/proton-mail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt