# SPF record for Proton Mail

URL: https://iblockspam.com/spf/proton-mail
Last updated: 2026-10-09

Include: include:_spf.protonmail.ch
Where it goes: Your domain (@)
DNS lookups: 2 of 10

To let Proton Mail send for your custom domain, add include:_spf.protonmail.ch to your domain's SPF record, for example v=spf1 include:_spf.protonmail.ch ~all. Proton shows the exact recommended record in the SPF tab of its domain setup. The include costs 2 DNS lookups. Proton uses ~all and warns that -all can cause delivery problems.

## Example records

- Proton Mail only (TXT, host @): `v=spf1 include:_spf.protonmail.ch ~all`
- Proton Mail and an existing record (TXT, host @): `v=spf1 include:_spf.protonmail.ch mx ~all` Proton says to add its include right after v=spf1 in the record you already have. Here the existing record allowed the domain's MX servers.

## Notes

- Proton describes `~all` as SoftFail (accepted but marked as failed) and warns that `-all` can get legitimate mail rejected, for example when it is forwarded.

## How to add it

- In Proton Mail, go to Settings, All settings, Domain names, and click Review next to your domain. Open the SPF tab.
- Copy the recommended record. If your domain already has an SPF record, add `include:_spf.protonmail.ch` to it right after `v=spf1` instead.
- Publish it as a TXT record at your DNS host and save.
- Return to the SPF tab: a green check mark shows Proton has found the include. Check the full record with the SPF Checker below.

## DKIM and DMARC

Proton gives you three DKIM CNAME records in its domain setup wizard; the host names and values must match the wizard exactly. Delete any old manual DKIM TXT record first. Proton's default DMARC policy is `p=none`; it recommends `p=quarantine`, and `p=reject` once legitimate mail passes DMARC.

**Q: What is the SPF record for Proton Mail?**
Add `include:_spf.protonmail.ch` to your domain's SPF record, right after `v=spf1`. Proton shows the exact recommended record in the SPF tab under Settings, Domain names.

**Q: Should I use -all with Proton Mail?**
Proton's example uses `~all`. It warns that `-all` (hard fail) can get legitimate email rejected, for example when SPF fails during forwarding. With DKIM and DMARC set up, `~all` is a reasonable choice. See our [soft fail vs hard fail guide](https://iblockspam.com/blog/spf-softfail-vs-hardfail).

**Q: How do I keep my existing SPF record when moving to Proton?**
Don't create a second record. Proton says to add `include:_spf.protonmail.ch` to your existing record, right after `v=spf1`. Remove includes for services you no longer use so you stay within 10 lookups.

Sources:
- Proton Support: Anti-spoofing for custom domains (SPF, DKIM, DMARC): https://proton.me/support/anti-spoofing-custom-domain

---

Source: iBlockSpam, https://iblockspam.com/spf/proton-mail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt