To let Proton Mail send as you, add include:_spf.protonmail.ch to your SPF.
On the custom domain; if you already have SPF, Proton says to add the include to it rather than create a second record. It authorises Proton’s servers to send for your domain. Measured on 4 Nov 2026, the include costs 2 of your 10 SPF lookups, leaving 8 for everything else.
- Include
- _spf.protonmail.ch
- Vendor’s record
- include:_spf.protonmail.ch
- Where it goes
- Your domain’s SPF record (@)
- Needed on your root?
- Yes, if you send through it from your domain
- Lookups (measured)
- 2 of 10
- Ranges published
- 11 ip4 · 0 ip6
- Category
- Mailbox provider
What include:_spf.protonmail.ch expands to live, 4 Nov 2026
v=spf1 ip4:185.70.40.0/24 ip4:185.70.41.0/24 ip4:185.70.43.0/24 ip4:79.135.106.0/24 ip4:79.135.107.0/24 ip4:109.224.244.0/24 include:_spf2.protonmail.ch ~all
Counted as RFC 7208 §4.6.4 does: the include itself plus every nested include, a, mx, ptr, exists and redirect. Includes can change at any time; this page re-measures daily.
Adding it next to another service
A domain has exactly one SPF record, so add the include to the record you already have. With Google Workspace, for example:
v=spf1 include:_spf.google.com include:_spf.protonmail.ch ~all
How it affects DMARC
DMARC passes when SPF or DKIM passes for a domain aligned with your From address. With Proton Mail sending from your domain, its include lets SPF pass and align; DKIM signing with your domain gives you a second, forwarding-proof way to pass.
Other mailbox provider services
Sources
- Proton: Anti-spoofing for a custom domain · checked 5 Oct 2026
- RFC 7208 §4.6.4: DNS lookup limits · checked 5 Oct 2026
peekip isn’t affiliated with Proton Mail; follow the vendor’s own setup page, which shows the exact values for your account.