Check the SPF record of any domain
Results for
proton.me
Email authentication
1 warning
Warning- SPF
- Pass:~all (soft fail), 2 of 10 lookups
- DMARC
- Warning:p=quarantine
- DKIM
- Pass:2 keys: protonmail, protonmail2
- MTA-STS
- Pass:Published
- TLS reporting
- Pass:Published
- BIMI
- Note:Declined
- Mail servers
- mail.protonmail.ch, mailsec.protonmail.ch
SPF record
2 of 10 DNS lookups
Passv=spf1 include:_spf.protonmail.ch ~all
- Uses 2 of 10 DNS lookups.
- Ends in ~all (soft fail), so receivers accept mail from unlisted servers but mark it as suspicious.
Includes
2 domains
- include:_spf.protonmail.ch2 lookups
- include:_spf2.protonmail.ch1 lookup
DMARC record
_dmarc.proton.me
Warningv=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;
- Policy p=quarantine: receivers send mail that fails DMARC to spam.
- No rua= address, so nobody receives the reports that show who sends mail as proton.me.
- Policy
- quarantine (send to spam)
- Subdomain policy
- quarantine (send to spam)
- Percentage
- 100%
- Aggregate reports
- None
- Failure reports
- None
- DKIM alignment
- Strict
- SPF alignment
- Strict
DKIM keys
24 selectors checked
Pass- protonmail._domainkey.proton.mePass:2048-bit RSA
Show record
v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn46zCm3zHBmS1zePKxA+RIXw41Nu6l91NpLLBnWnrcZ35H/843XNWPZEQ0OgGwx/yqTXETMLXIDjGEWlK1E1mpdguqu+3s7SuIHoo5+i6mgyxJguljkwc3dk8ojnJ6VVUPnDh5GJArkAhXxEb1aOK1BVGM0yDlmYdmaOfd48qcx5iODP/MFc8pivfxEXTIL+aUz7+X69lMiwUSHpWYL3/a5X3nLD0zEntxv08xs8J/rpuRg4v+OXEOhcNvhkeiRZqJBdpJTkoEZfGvdTct+U0YYC69NW0ClUcKio2uDPmxU1xvfvHbSTW2gHYk8RpYZaxLACULdMo+Vt4Na/oIR+swIDAQAB;
- protonmail2._domainkey.proton.mePass:2048-bit RSA
Show record
v=DKIM1;k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzyzKjxw9soyR/PtOaHGV2qeOR63FVUMlRr2ssw6yZQGea4O3DzioVtwQMjXhqkLSnthca9zIyInBEcWXbC2LwRWX0vXJrULQpFtY1anvBebUJgbX9W2TJUW8seVoVVcKk0DF4iENEtsWNPBpuGKdx1BPpN4OujjWFs7RN4oIMHnJpSIlxzX9hT8mwdlUuKA4GsOOBg8zpXQIeJy8jDWj2xrmd6GxGsSCBD4mRrqwscSWU+RN6vyUon8wT2b3HujvCCRUhIrd40tMeT9clyl7IZSTJu5M7q0+s/favDSKiyIMBG4Walzr5OuFMl2eEGwDp45s3jQZfjHlczjCeyjmEwIDAQAB;
Selectors we checked (24)
- selector1
- selector2
- default
- dkim
- k1
- k2
- k3
- s1
- s2
- smtp
- mx
- mandrill
- mxvault
- protonmail
- protonmail2
- fm1
- fm2
- sig1
- zmail
- kl
- s1024
- s2048
To check another selector, enter it as selector._domainkey.proton.me.
MTA-STS, TLS reporting and BIMI
Optional records
MTA-STS
v=STSv1; id=190906205100Z;
- MTA-STS is on (policy id 190906205100Z). The policy file lives at https://mta-sts.proton.me/.well-known/mta-sts.txt.
TLS reporting
v=TLSRPTv1; rua=https://reports.proton.me/reports/smtptls
- TLS reports go to https://reports.proton.me/reports/smtptls.
BIMI
v=BIMI1; l=; a=;
- The BIMI record has no logo (empty l=), so it declines BIMI.
Run this lookup from code
The API returns this result as JSON. The free plan includes 100 API calls per month.
curl "https://hostingchecker.online/api/v1/email-auth?query=proton.me" \
-H "Authorization: Bearer YOUR_API_KEY"How it works
How SPF works
When a server receives a message, it reads the domain in the envelope sender (the Return-Path) and looks up that domain's SPF record. If the sending server's IP address matches a mechanism in the record, SPF passes. If nothing matches, the all mechanism at the end decides the result.
SPF alone does not stop spoofing of the From address people see, because it checks the envelope sender only. DMARC closes that gap: it requires SPF or DKIM to pass for the same domain as the visible From address, and it tells receivers what to do when neither does.
- ip4 / ip6
- Allows an IPv4 or IPv6 address or range
- include
- Allows the servers in another domain's SPF record
- a / mx
- Allows the domain's own A or MX hosts
- all
- Matches everything else: -all fail, ~all soft fail
- redirect
- Uses another domain's SPF record instead
FAQ
SPF checker FAQ
Common questions about SPF records and why they fail.
Related guides
Learn more from the blog
Step-by-step guides on reading and using these results.
MX Record Check: How to Find a Domain's Mail Servers
Run an MX record check with a DNS lookup tool, dig or nslookup. See the current MX values for Google Workspace, Microsoft 365, Zoho, Proton and Fastmail, what a null MX means, and how to fix common email delivery problems.
DNS Records Explained: Every Record Type With Real Examples
DNS records explained: what A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR, CAA and HTTPS/SVCB records do, with real dig output from live domains and the fields of each record.
How to Check DNS Records for Any Domain (Online and Command Line)
Check DNS records for any domain with an online DNS record lookup, dig, nslookup, PowerShell or DNS over HTTPS. Real output for every command, plus how to query a specific resolver or the authoritative nameserver.
Related tools
More free tools
Explore our other free lookup and analysis tools.
Free lookup tool
Check the SPF record of any domain
Check the SPF record of any domain. See every include, the DNS lookup count against the limit of 10, the all qualifier and the errors that make SPF fail.