SPF record for Proton Mail

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Proton Mail only

Type: TXT · Host: @ · 2 of 10 DNS lookups Copy

v=spf1 include:_spf.protonmail.ch ~all

Proton Mail and an existing record

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:_spf.protonmail.ch mx ~all

Proton says to add its include right after v=spf1 in the record you already have. Here the existing record allowed the domain's MX servers.

How SPF applies to Proton Mail mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Proton Mail sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Proton describes ~all as SoftFail (accepted but marked as failed) and warns that -all can get legitimate mail rejected, for example when it is forwarded.

How to add it

1. In Proton Mail, go to Settings, All settings, Domain names, and click Review next to your domain. Open the SPF tab.
2. Copy the recommended record. If your domain already has an SPF record, add include:_spf.protonmail.ch to it right after v=spf1 instead.
3. Publish it as a TXT record at your DNS host and save.
4. Return to the SPF tab: a green check mark shows Proton has found the include. Check the full record with the SPF Checker below.

DKIM and DMARC alignment

Proton gives you three DKIM CNAME records in its domain setup wizard; the host names and values must match the wizard exactly. Delete any old manual DKIM TXT record first. Proton's default DMARC policy is p=none; it recommends p=quarantine, and p=reject once legitimate mail passes DMARC.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Proton Mail's include costs 2 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Proton Mail's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.