Proton Mail email DNS checker
Check the public DNS records that matter when Proton Mail is not receiving, sending, verifying, or passing authentication for a custom domain.
Proton Mail supports custom domains, but public DNS still decides whether mail is delivered to Proton and whether outgoing mail authenticates correctly.
Use this page to check the DNS pieces without guessing Proton's verification token or DKIM CNAME targets, which are generated for each domain in the Proton dashboard.
DNS records to check first
| Record | What to check | Safe note |
|---|---|---|
| MX | Proton Mail commonly uses mail.protonmail.ch at priority 10 and mailsec.protonmail.ch at priority 20. Confirm both exist and that no old provider MX records remain. | Follow the exact MX instructions in the Proton dashboard and keep the priorities Proton specifies so the backup host is not preferred over the primary. |
| SPF | If Proton Mail sends mail for the domain, the SPF record commonly includes _spf.protonmail.ch. | Merge Proton with any other real senders in one SPF record instead of publishing a second record. |
| DKIM | Proton uses three DKIM CNAME records, such as protonmail._domainkey, protonmail2._domainkey, and protonmail3._domainkey, each pointing at a target generated in the Proton dashboard. | Do not invent the CNAME targets. Copy all three exactly from the Proton dashboard, and keep them DNS-only if your DNS host offers proxying. |
| DMARC | Publish a DMARC record once SPF and DKIM are set up so receivers know how to handle failing mail. | Start with p=none monitoring before tightening policy, especially while the three DKIM CNAME records are still propagating. |
| Domain verification | Proton verifies domain ownership with a TXT record whose value starts with protonmail-verification=. Confirm the exact value from the Proton dashboard is published at the domain root. | Verification values are generated for your Proton account. Do not copy one from documentation or another domain. |
Common mistakes
- Publishing only one of the three Proton DKIM CNAME records, so DKIM never verifies.
- Proxying the DKIM CNAME records through a CDN setting instead of leaving them DNS-only.
- Setting both Proton MX records to the same priority or keeping an old provider's MX records alongside Proton's.
- Adding _spf.protonmail.ch as a second SPF record instead of merging it into the existing one.
Boundaries
Domain Email Doctor checks public DNS records only and does not access a Proton account.
Address creation, custom domain status, and verification progress stay inside the Proton dashboard.
Proton's verification token and the three DKIM CNAME targets must come from the Proton dashboard, and a passing DNS check does not guarantee inbox placement.