# Proton Mail: MX records and email verification

How Proton-hosted domains look in DNS, how Proton Mail answers a verification handshake, and which verdicts to expect for proton.me and custom domains.

Updated: 2026-09-03

Proton Mail is the encrypted mailbox service from Proton, used both on its own domains (proton.me, protonmail.com, protonmail.ch, pm.me) and on custom domains for paid plans. Spaw reports every Proton-hosted domain as `mx_provider: "proton"`.

## How Proton shows up in DNS

Proton domains publish two MX records, `mail.protonmail.ch` at priority 10 and `mailsec.protonmail.ch` at priority 20. Custom domains on Proton use the same two hosts. Spaw matches the `.protonmail.ch` suffix; Proton is a mailbox host, so the MX target is Proton's own inbound server and `mx_implicit` is false.

## How Proton answers a verification handshake

Proton typically rejects unknown recipients during the handshake, so unknown usernames on proton.me answer `mailbox_not_found` with `smtp_reason: no_mailbox` on the first attempt. Custom domains on Proton can have a catch-all address configured by the domain's administrator; those domains answer as catch-all. Proton's inbound servers are conservative with unfamiliar senders and occasionally defer a first connection, which shows up as an unverified answer with `smtp_reason: greylisted`.

## What that means for your verdicts

For Proton's own consumer domains, Spaw applies Proton's username rules before any probe: letters, digits, dots, underscores and hyphens. An address that breaks them is answered `undeliverable` with `reason: invalid_local_part` at no cost. Valid addresses are then probed and come back `deliverable` with `mailbox_exists: true` or `undeliverable` with `reason: mailbox_not_found`.

Custom domains behave like any business domain: a clean reject or accept when catch-all is off, `risky` with `reason: catch_all` and a `mailbox_confidence` estimate when it is on. Proton is not on Spaw's list of established providers for the confidence bonus, so the estimate leans on the domain's DMARC and SPF records, its registration age and the shape of the username.

## SPF and DMARC at Proton

Proton's anti-spoofing guide tells custom-domain owners to add `include:_spf.protonmail.ch` to their SPF record, to add the DKIM CNAME records from the Proton dashboard, and to publish DMARC starting with `p=quarantine`, moving to `p=reject` once legitimate mail passes. Proton's own domains publish strict policies. Spaw reports the live state of a custom domain in `has_spf` and `dmarc_policy`.

## Practical notes for sending to Proton users

Proton supports plus-addressing on its own domains, reported by Spaw as `is_alias: true`. Because Proton is chosen by privacy-conscious users, complaint rates on unsolicited mail tend to be high and Proton's filtering weighs sender reputation heavily, so authenticate your sending domain properly and avoid sending to addresses you have not verified. Proton's address book aliases (`pm.me` for paid users) resolve to the same account and are handled like any other Proton domain.

For a live look at any Proton-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.

Reference: https://spaw.co/email-providers/proton