protonmail.com
Good, with 2 things to fix
protonmail.com scored 84/100 (grade B). The main issues are BIMI record is malformed and no DMARC aggregate report address. Detected senders: Proton Mail.
Checked 2026-10-02 12:29 UTC · fresh check
Set up a DMARC report address
Without a rua address nobody receives aggregate reports, so you cannot see who sends as protonmail.com or tell when it is safe to tighten the policy. Adding reporting does not change how receivers treat your mail.
Applies to: _dmarc.protonmail.com
- Get an address that collects DMARC aggregate reports: add protonmail.com to MailVakt to receive one, or sign up with any DMARC report service. 2. Edit the TXT record at _dmarc.protonmail.com and add rua=mailto:<that address>, keeping every other tag (p=quarantine) as it is. 3. A report service on another domain must authorize protonmail.com; most publish that record for you.
All checks
MXCan servers find your inbox?No issues foundPass
Nothing to report.
SPFWho may send as you?SPF ends in softfail (~all)Info
- Info: SPF ends in softfail (~all)
"~all" is common and works well with DMARC. "-all" is stricter; switch when you are sure every sender is listed.
DKIMAre your emails signed?DKIM key publishedPass
- Pass: DKIM key published
protonmail.com publishes a DKIM key under protonmail3.
DMARCWhat happens to fakes?No DMARC aggregate report addressNeeds attention
- Warning: No DMARC aggregate report address
Without a rua address you receive no aggregate reports, so you cannot see who sends as your domain or safely tighten the policy.
How to fix this - Info: DMARC policy is quarantine; consider reject
Failing mail goes to spam rather than being refused. When reports show no legitimate failures, reject gives the strongest protection.
How to fix this - Info: DMARC uses strict alignment
With adkim=s or aspf=s the DKIM d= domain or the bounce domain must equal the From domain exactly; a subdomain is not enough. Third-party senders that sign or bounce from a subdomain (or their own domain) will then fail DMARC unless they are configured to use your exact domain.
AlignmentDoes it match your From?No issues foundPass
Nothing to report.
BIMICan inboxes show your logo?BIMI record is malformedNeeds attention
- Warning: BIMI record is malformed
The BIMI record at default._bimi.protonmail.com is invalid: the l= tag (SVG logo URL) is missing.
MTA-STSIs mail to you encrypted?No issues foundPass
Nothing to report.
TLS-RPTWill you hear about failures?TLS-RPT is configuredPass
- Pass: TLS-RPT is configured
TLS reports will be sent to https://reports.proton.me/reports/smtptls.
Other fixes
Strengthen the DMARC policyTXT
Rejects mail that fails DMARC, the strongest protection against spoofing. There is no report address yet: set one up first (see the DMARC reporting fix) so you can confirm your legitimate mail passes before enforcing.
_dmarc.protonmail.com
Some DNS providers want just “_dmarc” here.
v=DMARC1; p=reject; adkim=s; aspf=s
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;