ProtonMail MX Records: Complete Setup Guide

ProtonMail (now Proton Mail) is a privacy-focused email service based in Switzerland. When using a custom domain with Proton Mail, you need to configure MX records to route email through Proton's secure servers.

This guide covers MX setup for Proton Mail custom domains, including both consumer and business accounts.

Proton Mail MX Records

For custom domains on Proton Mail:

Both records are required. The primary server handles normal traffic, with mailsec as backup.

Why Switzerland (.ch)?

You might notice the .ch domain—this is Switzerland's country code. Proton Mail is headquartered in Geneva, Switzerland, and operates under Swiss privacy laws. All Proton Mail servers are located in Switzerland, which is reflected in the MX record hostnames.

This isn't a typo or regional variant—all Proton Mail users worldwide use the .ch MX records.

Adding Proton Mail MX Records

Step 1: Verify Your Domain in Proton

Before MX records will work, Proton Mail requires domain verification:

1. Log into your Proton account at mail.proton.me
2. Go to Settings → Proton Mail → Domain names
3. Click Add domain
4. Add the TXT verification record to your DNS
5. Complete verification in Proton's interface

Step 2: Access Your DNS Provider

Log into your domain registrar or DNS host (GoDaddy, Cloudflare, Namecheap, etc.).

Step 3: Remove Old MX Records

Delete any existing MX records from previous email providers. Mixed MX records cause delivery problems.

Step 4: Add Proton MX Records

Record 1 (Primary):

• Type: MX
• Host: @ (or blank for root domain)
• Value: mail.protonmail.ch
• Priority: 10

Record 2 (Backup):

• Type: MX
• Host: @
• Value: mailsec.protonmail.ch
• Priority: 20

Step 5: Complete Setup in Proton

Return to Proton Mail settings:

1. Go to Domain names → your domain
2. Click Verify for MX records
3. Proton confirms when records are detected

Why Two MX Records?

Proton Mail uses two MX servers for redundancy:

mail.protonmail.ch (Priority 10): The primary mail server. Handles all incoming email under normal conditions.

mailsec.protonmail.ch (Priority 20): Backup server. Receives email if the primary is temporarily unavailable.

Both servers deliver to the same Proton Mail infrastructure. The backup ensures email isn't lost during maintenance windows.

Proton Mail Plans and Custom Domains

Custom domain support varies by Proton plan:

Proton Free: No custom domain support. Use @proton.me or @protonmail.com addresses only.

Proton Mail Plus: 1 custom domain included.

Proton Unlimited: 3 custom domains included.

Proton Business: Multiple custom domains depending on plan.

MX record configuration is the same for all paid plans that support custom domains.

Additional Proton DNS Records

MX records handle incoming email routing. Complete your setup with:

SPF Record (TXT)

v=spf1 include:_spf.protonmail.ch ~all

This authorizes Proton's servers to send email from your domain.

Check at spfrecordcheck.com.

DKIM Records (CNAME) Proton provides three DKIM records. Find the exact values in:

1. Settings → Domain names → Your domain
2. Look for DKIM section
3. Add all three CNAME records as specified

Test at dkimtest.com.

DMARC Record (TXT)

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

Check at dmarcrecordchecker.com.

Verification TXT Record Added during initial domain setup. Keep this record—Proton may periodically re-verify.

Common Proton Mail MX Issues

"MX Records Not Found" During Verification

• DNS propagation may take up to 48 hours
• Verify you're editing the correct DNS zone
• Check for typos (especially the .ch extension)
• Ensure records saved successfully

Email Not Arriving After Setup

• Verify domain setup is complete (all steps green in Proton)
• Check that email addresses exist in Proton Mail
• Ensure no old MX records remain
• Wait for full DNS propagation

Verification Stuck on MX Step

• Both MX records must be present
• Priorities must be correct (10 and 20)
• Use exact hostnames: mail.protonmail.ch and mailsec.protonmail.ch
• Don't add trailing dots unless your DNS provider requires them

"Domain Already in Use"

Another Proton user may have previously configured your domain:

• Contact Proton support to resolve
• You may need to prove domain ownership

Catch-All and Subdomains

Proton Mail supports additional configurations:

Catch-all addresses: Receive email sent to any address at your domain. Enable in domain settings after MX configuration.

Subdomains: You can configure MX records for subdomains (e.g., mail.yourdomain.com) if using separate email for different purposes.

Migrating to Proton Mail

Moving from another email provider:

Before Migration

1. Export email from current provider (if needed—Proton has limited import)
2. Sign up for Proton Mail paid plan
3. Add and verify your domain
4. Create user addresses in Proton
5. Lower current MX record TTL 24-48 hours before switch

During Migration

1. Remove old provider's MX records
2. Add both Proton MX records
3. Complete verification in Proton settings
4. Test by sending from external account

After Migration

1. Verify email arrives in Proton Mail
2. Update any services that email your domain
3. Keep old email accessible briefly for stragglers
4. Manually move important old emails if needed

Privacy Considerations

Proton Mail's privacy features work automatically once MX records are configured:

• End-to-end encryption: For emails between Proton users
• Zero-access encryption: Proton cannot read your stored emails
• Swiss jurisdiction: Your data is protected by Swiss privacy laws
• No logging: Proton doesn't log IP addresses (paid plans)

MX records simply route email to Proton's servers where these protections apply.

Monitor Your MX Records

Checking once is good. Monitoring continuously is better. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.