Proton Mail email authentication
End-to-end encrypted mailbox provider; custom domains require a paid plan.
SPF record
Add Proton Mail to your domain's SPF record with this include:
include:_spf.protonmail.ch
A complete record for a domain sending only through Proton Mail:
v=spf1 include:_spf.protonmail.ch ~all
What it costs you
2 of your 10 DNS lookups. The include: itself costs one, and Proton Mail's record chains to 1 more.
Behind it are 11 IP ranges.
Live record
This is what _spf.protonmail.ch published when this page was generated:
v=spf1 ip4:185.70.40.0/24 ip4:185.70.41.0/24 ip4:185.70.43.0/24 ip4:79.135.106.0/24 ip4:79.135.107.0/24 ip4:109.224.244.0/24 include:_spf2.protonmail.ch ~all
Domains using Proton Mail
Found while resolving 293 well-known domains on 2026-08-04 — each authorises
_spf.protonmail.ch in its published SPF record:
DKIM
Enable DKIM inside Proton Mail and publish the selector record it generates. DKIM matters more than SPF for deliverability, because a DKIM signature survives forwarding while SPF does not — see how selectors work.
DMARC
Neither SPF nor DKIM protects the address your recipients actually see until DMARC ties them
to it. Once Proton Mail is authenticating, publish a DMARC record — start at
p=none with a reporting address and
tighten from there.
Check it worked
DNS changes take minutes to hours to propagate. Once published, run the domain through the checker — it resolves the full include chain and reports the real lookup count.