proton.me

Live email deliverability and anti-spoofing audit, read from public DNS. Generated 2026-07-29 06:42 UTC — this page is cached for up to 6 hours, so re-check after changing a record.

Findings

• spf

  SPF ends in ~all (softfail); unauthorised mail is marked rather than rejected.

  v=spf1 include:_spf.protonmail.ch ~all

  Fix: Move to -all once you have confirmed all senders are listed.

• dmarc rua

  DMARC has no rua address, so you receive no aggregate reports and are flying blind.

  v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;

  Fix: Add rua=mailto:dmarc@proton.me to the record.

• mx

  Mail is handled by Proton Mail.

  10 mail.protonmail.ch, 20 mailsec.protonmail.ch

• dmarc

  DMARC is enforcing with p=quarantine.

  v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;

• dkim

  DKIM keys found for 1 selector.

  protonmail._domainkey

• mta sts

  MTA-STS is published, so senders will refuse to downgrade to plaintext SMTP.

  v=STSv1; id=190906205100Z;

• tls rpt

  TLS reporting is enabled.

  v=TLSRPTv1; rua=https://reports.proton.me/reports/smtptls

• bimi

  BIMI is published; supporting clients can show your logo.

  v=BIMI1; l=; a=;

• dnssec

  DNSSEC is validating, so these records cannot be silently tampered with in transit.

  AD flag set

Records

Badge for your README

Live, re-checked every time someone loads the page. Free, no key required.

![deliverability](https://mailgrade.dev/badge/proton.me.svg)

Swap /badge/ for /badge/dmarc/, /badge/spf/, /badge/dkim/ or /badge/spoofable/ for a specific check. Add ?style=plastic if you prefer the gradient.

curl "https://mailgrade.dev/v1/domain?domain=proton.me"

Check another domain