iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To move business email for a custom domain to Proton, verify domain ownership, prepare users and addresses, then change inbound MX records and publish Proton’s SPF, DKIM, and DMARC records at your authoritative DNS host. Use the exact values shown in your Proton account, preserve other legitimate mail senders, and test mail flow after Proton detects the records.
Before you change DNS
You need control of the domain’s DNS zone, which is usually managed at the registrar or DNS hosting provider. Proton requires a custom domain and a paid plan; set up the Proton organization if your business needs multiple users. See Proton’s custom-domain setup guide and Proton’s business plans.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Yubico - YubiKey Bio C (FIDO Edition) - Basic Compatibility - Multi-Factor authentication (MFA)... | $98.00 | Buy on Amazon |
Find the domain’s authoritative DNS host before making changes. DNS fields and root-domain labels vary by provider, so use a provider-specific Proton guide where available. For example, Proton’s Namecheap guide shows SPF and DMARC as TXT records and DKIM as CNAME records; a root host may be entered as @ or as the domain name, depending on the interface.
Free tools Windows power users keep installed
One-click scans. No signup required.
Add and verify the domain in Proton
- In Proton, open the domain setup area in your organization settings and add the custom domain.
- Copy the TXT ownership-verification value Proton generates for that domain. Add it at the DNS host using the host/name and value fields required by that provider. Do not copy a sample verification string from an article.
- Return to Proton’s domain status screen and check that the ownership record is detected. Proton says initial verification may take a couple of hours after DNS changes; timing can vary.
Proton’s custom-domain instructions describe adding and verifying a domain.
#1 Best Overall
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Prepare users and addresses before inbound mail cutover
If several people are moving, create their corresponding Proton users and addresses before changing MX records. MX records determine where other mail systems deliver incoming mail, so switching them before the destination addresses are ready can disrupt delivery. Also prepare any aliases the business expects to use. Proton explicitly advises organizations to create corresponding addresses before changing MX in its migration guidance.
Publish the DNS records Proton provides
Make these changes in the authoritative DNS zone, not in Proton’s message composer. Use the values currently shown in Proton’s domain setup/review screen. The examples below explain the record roles; the DKIM hostnames and authentication values are specific to your domain and account.
| Record | What it does | What to configure |
|---|---|---|
| MX | Routes inbound mail for the domain. | Enter Proton’s current MX targets and priorities. Proton’s Cloudflare example uses mail.protonmail.ch at priority 10 and mailsec.protonmail.ch at priority 20; confirm the values in your account and follow your DNS provider’s instructions. Proton’s Cloudflare DNS guide. |
| SPF | Identifies sending hosts and services authorized to send for the domain. | Include Proton in the existing SPF policy, while preserving other legitimate senders. Maintain one SPF TXT policy rather than publishing a second one. Proton’s SPF, DKIM, and DMARC guidance. |
| DKIM | Lets recipients check a signature attached to outgoing messages. | Publish the three CNAME hostnames and destinations generated in Proton. Copy each completely and exactly. Proton says it handles automatic key rotation when these records are configured correctly; its guidance describes a new 2048-bit key every six months. Proton’s authentication guidance. |
| DMARC | Tells receiving systems what to do when authentication or alignment fails and can provide feedback. | Use the DMARC record and values supplied through Proton’s domain settings. Available policy choices include none, quarantine, and reject; choose in light of all legitimate services sending as the domain. Proton’s authentication guidance. |
SPF: keep all valid senders in one policy
If the domain already has an SPF record, edit and consolidate that policy to include Proton and any other authorized services, such as a CRM or mailing platform. Do not add a separate SPF TXT policy. Proton describes ~all as softfail and -all as hardfail; it warns that hardfail can reject legitimate messages and that forwarding often causes SPF failure. Check the domain’s senders and forwarding arrangements before tightening the policy.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDKIM: use the generated CNAMEs exactly
Do not invent or adapt DKIM names or destinations. Copy all three hostnames and targets from Proton. DNS providers differ in whether a destination should end with a period; follow that provider’s input rules, then confirm Proton detects the records.
DMARC: choose a policy based on your senders
A policy is not universally safe for every business. Before using enforcement such as quarantine or reject, account for every legitimate service sending mail as the domain. Proton’s cited guidance lists the policy options but does not prescribe a universal monitoring period or rollout schedule.
Verify records and test mail flow
- After publishing the records, return to the domain status page in Proton and check that it detects MX, SPF, DKIM, and DMARC as configured.
- Send test messages into the domain and out from it. Check each intended user address and alias, along with any forwarding paths the business relies on.
- Test every business service or device that sends using the domain, including applications such as a CRM or printer. Proton’s green status indicators confirm record detection; they do not by themselves establish that every real-world sending path works.
Allow time for DNS changes to be detected, but do not assume a universal propagation or cutover time. Proton notes that initial verification can take a couple of hours. Its domain setup instructions and authentication guide explain the record checks.
Connect business apps and devices that need to send mail
MX and authentication records do not configure an application to submit messages. For a printer, CRM, or other app that needs to send through a Proton address, Proton offers SMTP submission using a generated SMTP token. This is for sending; IMAP is used to retrieve mail in third-party clients. Proton says SMTP-submitted messages are not end-to-end encrypted, though messages receive zero-access encryption when stored in Proton. Follow Proton’s SMTP submission instructions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
