Email authentication: proton.me
Can someone send email pretending to be your domain? Check all three records at once, see a score, and get the exact fix for anything missing or broken.
Try: google.com · proton.me · github.com
Well protected proton.me
Receives email at mail.protonmail.ch (+1 more). Checked Thu, 12 Nov 2026 14:40:17 UTC.
SPF valid
Edit in SPF generator →v=spf1 include:_spf.protonmail.ch ~all
Authorized senders we recognise: Proton Mail
Include tree (1 include)
- proton.me 1 lookup
- _spf.protonmail.ch Proton Mail 1 lookup
- _spf2.protonmail.ch 0 lookups
- _spf.protonmail.ch Proton Mail 1 lookup
- "~all" (soft fail) is the common, safe choice. With DMARC at quarantine or reject, failing mail is still blocked.
DMARC p=quarantine
Edit in DMARC generator →Found at _dmarc.proton.me
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;
| Tag | Value | Meaning |
|---|---|---|
| v | DMARC1 | Version |
| p | quarantine | Policy for this domain |
| fo | 1 | When to send failure reports |
| aspf | s | SPF alignment (r = relaxed, s = strict) |
| adkim | s | DKIM alignment (r = relaxed, s = strict) |
- Policy is "quarantine": failing mail goes to spam. The strongest setting is p=reject.
- No "rua" reporting address, so you get no reports on who sends email as your domain. Add rua=mailto:you@yourdomain.
- Strict alignment (adkim/aspf=s) is set: mail from subdomains or other domains you use won't align. Fine if intended.
DKIM 2 found
| Selector | Usually | Key | Status |
|---|---|---|---|
| protonmail | Proton Mail | RSA 2048-bit | good |
| protonmail2 | Proton Mail | RSA 2048-bit | good |
Extras
- MTA-STS
- on v=STSv1; id=190906205100Z;
- TLS-RPT
- on v=TLSRPTv1; rua=https://reports.proton.me/reports/smtptls
- BIMI
- on v=BIMI1; l=; a=;
SPF, DKIM and DMARC in plain English
| Record | What it does | Where it lives |
|---|---|---|
| SPF | Lists the servers allowed to send email as your domain. | yourdomain.com (TXT) |
| DKIM | A signature on every email, proving it wasn't changed and really came from you. | selector._domainkey.yourdomain.com |
| DMARC | Tells receivers what to do when SPF and DKIM fail (nothing, spam folder or reject) and sends you reports. | _dmarc.yourdomain.com |
You need all three. SPF and DKIM prove who sent a message; DMARC is the rule that makes the proof matter. Without DMARC, a spoofed email that fails SPF can still land in the inbox.
Who requires this
Gmail and Yahoo have required SPF, DKIM and a DMARC record from anyone sending 5,000+ emails a day to their users since February 2024, and Outlook.com followed in 2025. Smaller senders aren't blocked outright, but mail without them is far more likely to land in spam. If you send invoices, password resets or a newsletter from your domain, set them up.
The SPF 10-lookup limit
Every include, a, mx, ptr, exists and redirect costs one DNS lookup, and includes inside includes count too. Past 10, SPF fails for every email. It's the most common SPF error we see, usually after adding a newsletter tool, a CRM and a help desk on top of the inbox provider. The checker counts the whole tree for you.
How to find your DKIM selector
DKIM keys live at a name you can't guess: selector._domainkey.yourdomain.com. We try the 34 selectors the big providers use. If yours isn't found, send an email from your domain to a different mailbox (a personal Gmail works), open it there and choose Show original. Gmail lists SPF, DKIM and DMARC results at the top. If DKIM says PASS, copy the value after s= in the DKIM-Signature header and enter it in the selector box. If there's no DKIM line or header at all, DKIM isn't turned on: enable it in your email provider's dashboard, which gives you the record to add.
Don't check a copy in your own Sent folder: when Gmail sends through another provider's server ("Send mail as"), the signature is added after Gmail keeps its copy, so the Sent copy never shows it.
The safe order to fix things
- Publish one SPF record listing every service that sends as you (SPF generator).
- Turn on DKIM in each of those services (they give you the record).
- Publish DMARC with
p=noneand a report address (DMARC generator). - After 2-4 weeks of clean reports, move to
p=quarantine, thenp=reject.
FAQ
How do I check my SPF, DKIM and DMARC records?
Enter your domain above. The checker reads all three records from public DNS, follows every SPF include, tries the common DKIM selectors, and gives a score out of 100 with a fix for each problem.
What is a good email authentication score?
Above 85 means SPF is valid, DKIM is signing with a strong key and DMARC is enforcing (quarantine or reject). Between 55 and 85 usually means DMARC is still at p=none or DKIM wasn't found. Below 55, your domain is easy to spoof.
Why does it say DKIM not found when I have DKIM?
DKIM keys sit at a selector name chosen by your email service. We try the common ones; if yours uses a custom selector, send an email to a different mailbox, open "Show original" there, and copy the s= value from the DKIM-Signature header. If the received email has no DKIM-Signature at all, DKIM isn't enabled yet.
Can I have two SPF records?
No. A domain must have exactly one SPF record. Two records make SPF fail for all your email. Merge them into one record with every include; the SPF generator does this for you.
Is p=none enough for DMARC?
It meets the Gmail and Yahoo minimum and gets you reports, but it doesn't stop spoofing. Use it for a few weeks to confirm your real senders pass, then move to quarantine and reject.
Does a domain that doesn't send email need these records?
Yes, it's the easiest domain to spoof. Publish "v=spf1 -all" and "v=DMARC1; p=reject" so receivers reject anything claiming to come from it.
CHANGING HOSTS?
DNS is where most migrations go wrong. Follow the hosting switch checklist, lower your TTL a day before, and use the propagation checker after the switch. Comparing new hosts? See real renewal prices.