MailFixIt

Proton Mail email configuration guide

Proton Mail: DKIM record not verifying

Proton cannot verify one or more DKIM CNAMEs, or the sent message is not using the expected signing domain and selector.

Problem description

A provider setup symptom may look like:

DKIM record not verifying after a provider DNS change.

Check the sending domain

What this usually means

One or more Proton Mail DKIM CNAME records is missing or does not exactly match the value generated for the custom domain. Proton uses multiple selectors so it can rotate keys safely.

Fix it

  1. In Proton Mail, open Settings → Domain names and review the exact custom domain.
  2. Copy every DKIM hostname and CNAME target shown there; do not reuse values from another domain.
  3. Publish all records in the authoritative DNS zone. Avoid a duplicated domain suffix, proxying, CNAME flattening, or a TXT record in place of CNAME.
  4. If migrating from old manual TXT-based DKIM, follow Proton’s current migration order rather than leaving a conflicting record at the same selector.
  5. Wait for Proton to show the records as verified, then send a new message and confirm its d=, s=, and dkim=pass values.

Common mistake

One verified selector is not a substitute for the complete selector set Proton generated. DNS may also be correct before Proton has activated signing.

What MailFixIt can check

MailFixIt can inspect public DKIM data for a supplied selector. It cannot view Proton account state or initiate verification.

Use the related DKIM guide for a missing CNAME target or invalid public key.

Frequently asked questions

What does MailFixIt check for Proton Mail?

It can query a supplied selector and detect missing or malformed public DKIM data. Proton must confirm all generated records and active signing.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Proton Mail official setup guidance.