What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To move business email to Proton safely, first verify your domain, create the Proton users and addresses your team needs, then change MX and publish SPF, DKIM, and DMARC records using the values shown in your Proton account. Verify the DNS records in Proton and test real mail flow—including any third-party services that send from your domain—before considering the migration complete.
Before you change DNS
You need a domain and a paid Proton plan to use a custom domain with Proton Mail. For a multi-person business, set up the Proton organization as needed. DNS records are edited wherever your domain’s authoritative DNS zone is hosted, which may be your registrar or a separate DNS provider. Proton’s custom-domain setup guide explains the account setup.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Yubico - YubiKey Bio C (FIDO Edition) - Basic Compatibility - Multi-Factor authentication (MFA)... | $98.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Find the DNS host’s record editor and keep the Proton domain setup page available. Record names and values are generated for your domain; do not copy authentication values or verification codes from an example.
Add and verify your domain
- In Proton Mail settings, open the custom-domain setup flow and add your domain.
- Copy the TXT ownership-verification value Proton provides, then add it as a TXT record at your DNS host. Use the host/name field format required by that provider; the root domain may be entered as
@or as the domain name. - Return to Proton’s domain setup page and verify that it detects the TXT record. DNS updates may take a couple of hours to be detected, so check the status again if verification is not immediate.
Proton’s Namecheap setup guide illustrates provider-specific record entry. Use a dedicated guide for your DNS provider when available; labels and input conventions can differ.
#1 Best Overall
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Prepare users and addresses before the mail cutover
If you are moving multiple people, create the corresponding Proton users and addresses before changing MX records. MX changes direct incoming mail for the domain to Proton; preparing mailboxes and addresses first reduces the risk of routing messages to destinations that are not ready.
Check the full address list before proceeding, including shared or role-based addresses and aliases your business relies on. The addresses people use and the addresses external services send to must be available in the Proton setup before the routing change.
Change MX records to route incoming mail
MX records tell other mail systems where to deliver messages addressed to your domain. Changing them is the inbound-mail cutover. Proton’s Cloudflare example uses these MX destinations and priorities:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors| Priority | Mail server |
|---|---|
| 10 | mail.protonmail.ch |
| 20 | mailsec.protonmail.ch |
Those are the values in Proton’s Cloudflare guide; confirm the current MX values displayed in your own Proton setup and follow your DNS host’s instructions. Remove or replace conflicting MX records as Proton’s setup instructions direct. Do not assume an example applies unchanged to every account or provider.
Publish SPF, DKIM, and DMARC
Proton recommends SPF, DKIM, and DMARC for custom domains. Add them at the authoritative DNS host, using the names and values in Proton’s domain setup or review screen. Proton’s anti-spoofing guide explains the records and how they work together.
SPF: authorize every legitimate sender
SPF identifies which services are permitted to send mail for your domain. Include Proton in the policy, but also preserve any other legitimate senders, such as business applications or services that send as your domain.
A domain should have one SPF policy, not separate SPF TXT records for different senders. If one already exists, edit and consolidate it to include the authorized services rather than publishing a second policy. Proton describes ~all as softfail and -all as hardfail. A hardfail can reject legitimate messages if a sender was missed, and forwarding often causes SPF checks to fail, so do not tighten the policy without accounting for your senders and mail flows.
DKIM: copy Proton’s generated CNAME records exactly
DKIM lets receiving systems check a signature attached to outgoing mail. Proton generates three CNAME hostnames and their destination values for your domain. Copy each complete hostname and destination exactly from the account workflow; do not construct or substitute values yourself.
DNS providers differ in how they handle a trailing period in a destination. Follow your provider’s input rules, then check Proton’s status page to confirm that each record is detected. When the records are configured correctly, Proton handles automatic DKIM key rotation. Its guidance says it generates a new 2048-bit key every six months.
DMARC: choose a policy only after identifying senders
DMARC tells receiving systems how to handle messages that fail authentication or alignment and can provide feedback about those messages. Proton supplies the DMARC record through its domain settings. Its policy choices include none, quarantine, and reject.
There is no one enforcement policy that is safe for every business. Before choosing a stricter policy, account for all services that send mail using your domain; a legitimate sender that is not configured or aligned correctly can be affected. Proton’s cited guidance does not prescribe a universal monitoring period or rollout schedule.
Recommended Free Tools
Verify DNS and test the migration
After publishing the records, return to Proton’s domain status page and confirm that it detects the MX, SPF, DKIM, and DMARC configuration. A green status indicator means Proton detected the configured record; it does not by itself demonstrate that every business mail flow works as intended.
Test actual sending and receiving with the addresses and services your business uses. Include:
- Inbound messages to individual users, shared addresses, and aliases.
- Outbound messages from team members using the custom domain.
- Forwarding arrangements, if used.
- Each CRM, newsletter platform, printer, or other service that sends using your domain.
Allow for DNS detection time, which Proton says can be a couple of hours, but do not rely on a universal propagation or cutover time. If a record remains unverified, compare the DNS entry character for character with Proton’s generated value and check the provider’s host/name format and trailing-period behavior.
Connect business apps and devices that need to send
A printer, CRM, or other application may need to send mail through a Proton address. Proton offers SMTP submission using a generated SMTP token. This is a sending integration; IMAP is used to retrieve mail to third-party clients. SMTP submission does not provide end-to-end encryption for submitted messages, although Proton says they receive zero-access encryption when stored in Proton. Configure this separately from DNS: it does not replace MX, SPF, DKIM, or DMARC.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
