Proton Mail MX Records: proton.me and protonmail.com Servers

Updated 30 October 2026 · Volt Ghost team

proton.me MX records

We read these records from Cloudflare's public DNS-over-HTTPS resolver on 30 October 2026. Sending servers try the lowest priority number first and only use the next one if the first doesn't answer.

All three domains share one pair of servers under Proton's Swiss .ch domain. The priority numbers differ between proton.me and the two older domains, but the order is the same, so a sender behaves identically. When we checked, each of the two host names returned three IPv4 addresses, so the pair is backed by more machines than two names suggest. That's a different shape from Gmail's five-step ladder or Outlook's single host per domain.

Proton's sender authentication records

• Strict DMARC alignment: aspf=s and adkim=s mean the domain in the From line must match the SPF and DKIM domains exactly, not just share a parent domain. Together with p=quarantine, that is stricter than Gmail's monitor-only p=none. pm.me relaxes DKIM alignment (adkim=r) and is otherwise the same.
• MTA-STS in enforce mode: Proton's policy file at mta-sts.proton.me says mode: enforce and lists only the two hosts above. A sending server that supports MTA-STS must refuse to deliver if it can't set up verified TLS to one of them. Gmail and Outlook.com also enforce their policies, while Yahoo, GMX and Fastmail were still in testing mode when we checked.
• An empty BIMI record: BIMI is how a brand logo gets shown next to mail in some inboxes. Proton publishes the record but leaves the logo (l=) and certificate (a=) blank, which is the standard way to say "no logo for this domain".
• SPF through an include: _spf.protonmail.ch lists Proton's outbound IP ranges and chains to a second record, so custom domains on Proton include the same name.

When Proton's MX records matter

If you're moving your own domain to Proton, these two host names are what your MX records should end up pointing to, and our email host lookup will then name Proton Mail as the provider. If you send mail to Proton users and see a TLS error in your logs, the enforced MTA-STS policy is the likely reason: Proton would rather not receive a message than receive it over an unverified connection. You can read the authentication results on a message you received with our email header analyzer.

Proton Mail versus a temp inbox

Proton is a long-term private mailbox, and its free plan needs an account. A temporary inbox like Volt Ghost is the opposite trade: no account, but the address is gone after 24 hours. For anything you'll log back into, a private provider or an alias is the better choice, as covered in when not to use temp mail. Sign-up forms that score email addresses will see Proton's MX hosts as a mainstream provider, which how sites detect disposable email explains.

Questions