DKIM for Proton Mail: Custom Domain Setup Guide

This guide is part of our Email Providers series.

If you use Proton Mail with a custom domain, setting up DKIM is one of the most important things you can do for email deliverability. Without it, emails sent from your domain are more likely to end up in spam folders or get rejected entirely by providers like Gmail and Outlook.

The good news: Proton Mail handles most of the heavy lifting. You just need to add a few DNS records and verify them. This guide walks you through the entire process.

Why DKIM Matters for Your Custom Domain

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. Receiving mail servers use that signature to confirm the message actually came from your domain and wasn't tampered with in transit.

Without DKIM enabled on your Proton Mail custom domain, you risk:

• Emails landing in recipients' spam folders
• Messages being silently rejected by major providers
• Failing DMARC policy checks if you have a DMARC record
• Clients and contacts questioning whether your emails are legitimate

What You Need Before You Start

Before configuring DKIM, make sure you have:

• A paid Proton Mail plan (Mail Plus, Proton Unlimited, or Business) - custom domains aren't available on the free plan
• Access to your domain's DNS settings through your domain registrar or DNS provider (e.g., Cloudflare, Namecheap, GoDaddy)
• Your custom domain already added in Proton Mail (or ready to add)

Setting Up DKIM for Proton Mail

Understanding Proton Mail's DKIM Records

Proton Mail uses a setup that differs from most other email providers. Here's what makes it distinct:

The reason Proton uses CNAME records instead of TXT records is key rotation. With CNAME records pointing to Proton's servers, Proton can rotate your DKIM keys automatically without you ever needing to update your DNS again. Three selectors provide redundancy - if one key is being rotated, the others continue signing your mail.

Common Issues and How to Fix Them

DKIM verification fails in Proton Mail

The most common cause is incorrect DNS formatting. Some DNS providers automatically append your domain to the host field. If Proton gives you protonmail._domainkey.yourdomain.com, you may only need to enter protonmail._domainkey as the host - your DNS provider adds the domain portion. Check your provider's documentation or look at how existing records are displayed.

Records added but Proton still shows "Pending"

DNS propagation takes time. Wait at least one to two hours before troubleshooting. If records still aren't detected after 24 hours, double-check that you created CNAME records (not TXT records) and that the values match exactly what Proton provided.

DKIM passing for Proton but failing for other senders

If you also send email through other services (marketing tools, CRM systems, transactional email providers), each service needs its own DKIM configuration. Proton's DKIM records only cover mail sent through Proton Mail itself.

Completing Your Email Authentication

DKIM is one piece of a three-part email authentication system. For the best deliverability with your Proton Mail custom domain, you should also configure:

• SPF (Sender Policy Framework) - Proton provides an SPF TXT record during domain setup. This tells receiving servers which mail servers are authorized to send on behalf of your domain.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) - A DMARC record ties SPF and DKIM together with a policy that tells receivers what to do when checks fail. Start with a monitoring policy (p=none) and tighten it over time.

Proton Mail's domain setup wizard guides you through all three. Complete each step for the strongest possible email authentication.

Verifying Everything Works

After Proton confirms your DKIM records, send a test email to a Gmail or Outlook address. Open the message, then:

1. In Gmail: Click the three dots menu > "Show original" and look for dkim=pass
2. In Outlook: View the message headers and search for dkim=pass

If you see dkim=pass alongside the Proton selector, your setup is working correctly.

References

• RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
• Proton Mail official documentation — Custom domain DKIM configuration

---

Using Proton Mail with a custom domain? Make sure your DKIM records are properly configured so every message reaches the inbox.