ProtonMail Custom Domain Setup: SPF Record Guide

Setting up an SPF record for your custom domain ensures that ProtonMail is officially authorized to send emails on your behalf, preventing spoofing and reducing the likelihood your messages land in the spam folder. When you use a custom domain with secure email providers, the receiving mail server checks your domain's DNS zone to verify whether the sending server has permission. Without a proper Sender Policy Framework entry, your outbound messages may be rejected by strict receiving filters.

To build your policy correctly without syntax errors, you can use the SPF Record Generator to automatically format your authorized sending mechanisms and include statements.

Understanding SPF and How ProtonMail Uses It

Sender Policy Framework is a standard email authentication protocol that specifies which mail servers are permitted to send email on behalf of a given domain. It is published as a DNS TXT record containing a list of authorized IP addresses, netblocks, and third-party service include mechanisms.

When a recipient server receives an email claiming to be from user@example.com, it queries the Domain Name System for a TXT record starting with v=spf1. If the IP address of the server transmitting the email matches an authorized entry in that record, the SPF check passes.

ProtonMail operates its own outbound infrastructure. Because you are routing mail through their servers rather than your own web host or generic SMTP provider, your domain must explicitly grant permission to ProtonMail's servers within your DNS settings.

ProtonMail SPF Record Syntax Explained

ProtonMail provides specific guidelines for what your policy must include. A standard SPF configuration for a domain utilizing ProtonMail typically looks like this:

v=spf1 include:spf.protonmail.ch ~all

Let's break down each component of this record:

• v=spf1: Defines the version of SPF being used. This must always be at the very beginning of the record.
• include:spf.protonmail.ch: Directs the checking server to evaluate the SPF policy defined by ProtonMail, which automatically incorporates their authorized sending IP ranges.
• ~all: The softfail mechanism. It tells receiving servers that any mail coming from a source not explicitly listed should be treated with suspicion (a softfail) rather than outright rejection, which is recommended during initial setup to prevent delivery loss due to misconfigurations.

Combining Multiple Providers

Many organizations do not rely solely on an email provider; they also send transactional messages via platforms like SendGrid or use Google Workspace for other users. Because a domain can only have one active SPF record, you must combine all authorized senders into a single string.

If you use both ProtonMail and Google Workspace, your combined DNS TXT record would look like this:

v=spf1 include:spf.protonmail.ch include:_spf.google.com ~all

Note: An SPF record must never contain more than 10 DNS lookups (including nested includes), or the evaluation will fail permanently.

Step-by-Step Configuration Guide

Adding your record requires access to the DNS management console of your domain registrar or cloud DNS provider (such as Cloudflare, AWS Route 53, or Namecheap). Menu paths vary slightly depending on your provider, but you will generally look for sections labeled DNS Management, Zone Editor, or Manage Domains.

Step 1: Log in to Your DNS Provider

Navigate to your domain registrar's control panel and locate the DNS settings or zone file editor for example.com.

Step 2: Check for Existing Records

Look through your existing TXT records to see if a v=spf1 entry already exists.

• If no record exists, you will create a new one.
• If an existing record exists from a previous email provider, you must edit it to include ProtonMail rather than creating a second record.

Step 3: Add or Update the TXT Record

Create a new record with the following parameters:

• Type: TXT
• Host / Name: @ (or leave blank, representing your root domain example.com)
• Value / Answer: v=spf1 include:spf.protonmail.ch ~all
• TTL (Time to Live): Set to 3600 seconds (or default)

Step 4: Save Changes

Save the record in your provider's dashboard. DNS propagation can take anywhere from a few minutes to 24 hours.

Verifying Your Setup

After updating your DNS settings, verify that the record is published correctly and readable by public resolvers. You can use standard command-line tools or online utilities.

Using Dig (Linux / macOS)

Run the following command in your terminal to query the TXT records for your domain:

dig example.com TXT

Look for the response section in the output:

;; ANSWER SECTION:
example.com.		300	IN	TXT	"v=spf1 include:spf.protonmail.ch ~all"

Using PowerShell (Windows)

Open PowerShell and run the resolve command:

Resolve-DnsName -Name example.com -Type TXT

Ensure the string matches your intended configuration without typos.

Common Mistakes and How to Fix Them

Even experienced engineers occasionally make configuration errors that break email delivery. Avoid these common pitfalls:

• Multiple SPF Records: Creating two separate TXT records starting with v=spf1 invalidates your policy entirely. Receivers do not know which one to trust. Always merge all inclusions into a single TXT record.
• Typos in the Include Statement: Typing include:protonmail.ch instead of include:spf.protonmail.ch results in a permanent lookup failure because the subdomain spf. is required.
• Using the IP Mechanism Incorrectly: Avoid hardcoding specific ProtonMail IP addresses (e.g., ip4:192.0.2.1) unless explicitly instructed by advanced support configurations. ProtonMail manages its infrastructure dynamically, and hardcoded IPs will break when their network updates.
• Exceeding the Lookup Limit: Nesting too many third-party services inside include statements causes a permerror. Keep your includes strictly to necessary business services.

Quick Checklist for ProtonMail SPF Success

• Identified your domain's DNS management provider.
• Checked for any pre-existing SPF records to avoid duplicates.
• Formatted the string to include v=spf1, include:spf.protonmail.ch, and a qualifier like ~all.
• Published the TXT record at the root domain (@).
• Verified propagation using dig or PowerShell.
• Combined DKIM and DMARC records alongside SPF for complete email security.