How to Set Up Proton Mail: 2FA, Bridge & Custom Domain

Proton Mail hosts email on a domain you own on every paid plan; the free plan only gives you an @proton.me or @protonmail.com address. Mail Plus, at $3.99 a month billed yearly (October 2026), covers one domain. Connecting it takes a verification TXT record, two MX records, SPF, three DKIM CNAMEs starting at protonmail._domainkey, and DMARC.

If the choice between providers is still open, the ProtonMail vs Tuta comparison covers the tradeoffs before you commit an address to one of them; if Tuta fits better, our Tuta setup guide covers its first-run settings. The encrypted email provider matcher turns your hard requirements into a shortlist in about a minute.

For the provider-agnostic version of this process, what secure mail protects and how to set it up covers the decisions that apply whichever provider you land on.

Creating Your Account

Go to proton.me and choose a plan. The free tier is a legitimate option for getting started: up to 1 GB storage, one email address, limited sending volume. If you know you’ll use it seriously, the Mail Plus plan removes send limits and adds custom domain support.

The free/paid line matters more than the price, because three of the things people specifically come to Proton for sit on the paid side of it:

One trap in that table: Mail Plus is the cheapest tier that unlocks custom domains and Bridge, but it is not the tier that unlocks Proton Sentinel, the elevated account-protection program. Sentinel starts at Proton Unlimited. If account takeover rather than custom-domain sending is what you are buying against, Mail Plus is the wrong plan.

Check the current plan limits before deciding; Proton revises storage and address counts more often than it revises the encryption model. The encryption itself is identical on every tier — paying buys reach and convenience, not stronger cryptography.

Choosing your address: @proton.me and @protonmail.com are both available and functionally identical. You can add aliases later on paid plans. Proton’s own domains are not all equally open:

Username considerations: Your Proton username is permanent. Choose carefully. If you’re using this for anything serious, avoid anything that ties to your real name if anonymity matters to you.

Phone number: Proton may ask for a phone number or email for account verification. This is to prevent spam account creation. If you’re privacy-conscious about not linking your phone to Proton, you can sometimes use a secondary email for verification, or wait and try again — verification requirements vary based on signup patterns.

Initial Account Settings

After signup, go to Settings → All Settings and review these:

Account and password → Two-factor authentication: Enable this immediately. Proton offers an authenticator app (for example Proton Authenticator, Aegis on Android or Ente Auth) and FIDO2/U2F security keys, per Proton’s 2FA guide; a security key resists phishing best. Proton has no SMS second factor. Store the recovery codes it shows offline.

Security → Recovery: Set a recovery method. If you lose your password and have no recovery, your account is unrecoverable — this is a property of the encryption model. Proton cannot reset your password and maintain E2EE. Set a recovery phrase and store it somewhere safe (a password manager works well).

Email → Privacy: Review these options:

• Block email tracking pixels: Enable this. Tracking pixels are invisible images embedded in marketing email that report when and where you opened a message. ProtonMail can block them.
• Request link confirmation before opening: Optional, but adds a confirmation before opening external links, reducing accidental clicks on phishing links.

Setting Up Proton Mail Bridge (Paid Feature)

If you want to use ProtonMail with Thunderbird, Apple Mail, or Outlook instead of the web app, you need Proton Mail Bridge. It runs locally and handles the encryption/decryption, presenting a standard IMAP interface to your email client. Bridge handles Proton’s encryption itself; Thunderbird’s built-in OpenPGP, covered in Thunderbird PGP setup, is for accounts at providers without built-in end-to-end encryption.

1. Download Proton Mail Bridge from proton.me/mail/bridge

2. Install and sign in with your Proton credentials

3. Bridge will show you an IMAP hostname (127.0.0.1), port, and a generated password

4. Configure your email client with these settings:

   • IMAP: server 127.0.0.1, port 1143, STARTTLS, the generated password
   • SMTP: server 127.0.0.1, port 1025, STARTTLS, the generated password

   Bridge can serve either STARTTLS or SSL and will tell you which it is set to; match the client to Bridge rather than the other way round. If those ports are already taken on your machine, Bridge lets you shift them by one (1144 and 1026) under Settings → Advanced.

Bridge needs to be running for the email client to work. It starts on login by default.

Settings worth changing once the account is running

These are the settings people come back for, ordered by how much they change if something goes wrong.

Recovery phrase versus recovery email. They do different jobs, and the distinction is the most misunderstood thing in the product. A recovery email or phone restores account access but not your encryption keys, so historic encrypted mail can stay unreadable afterwards. A recovery phrase is a backup of the key material and restores the mailbox itself. Set both; if you set only one, set the phrase, and store it outside any password manager that this same address can reset.

Address verification (Encryption and keys → Address verification). Off by default. It pins a contact’s public key so a silent key change is flagged instead of trusted automatically, which closes the one gap that makes provider-managed end-to-end encryption a trust decision rather than a guarantee.

Block remote content (Email settings → Privacy and security). Stops externally hosted images loading until you ask, which also suppresses the IP-address leak that loading them causes. Pair it with the tracking-pixel block above.

Proton Sentinel (Security and privacy). An elevated account-protection program that applies stricter challenges to suspicious sign-ins and escalates them to human analysts. Worth enabling for an address that is the recovery route for other accounts. It is included from Proton Unlimited up, not on Mail Plus.

Sending from an app or server

Bridge is for a person reading mail in a desktop client. If an application, server, or website needs to send as your custom domain, Proton offers SMTP submission instead: a token-authenticated connection to smtp.protonmail.ch on port 587 (STARTTLS), available on any paid plan but only for a custom-domain address, never a @proton.me one. The token is generated per address in settings and is the only credential that works there; your account and mailbox passwords are both rejected. Mail sent this way is not end-to-end encrypted, because the sending application holds no keys, which is the right tradeoff for transactional mail and the wrong one for correspondence.

Proton Mail Custom Domain Setup

If you have a custom domain, adding it to ProtonMail lets you send and receive email as an address at yourdomain.com while using Proton’s infrastructure. It needs a paid plan, and Proton is not a domain registrar, so buy the domain elsewhere first. Domain counts below are from Proton’s plan guide and add-ons page; prices are per month on annual billing, checked in October 2026 on the consumer and business pricing pages.

Only the Workspace plans can buy more domains; every other allowance is fixed.

The DNS records Proton asks for

MX values and DKIM host names are from Proton’s Cloudflare guide; the SPF string is the form DMARC Creator documents. Copy every value, including your domain’s unique <id>, from Proton’s Review screen.

1. Go to Settings → All settings → Domain names (under Organization on some plans), click Add domain, and enter it, per Proton’s setup guide. Business plans create an organization first.
2. Publish the verification TXT record at @, TTL 300 if offered. If the panel rejects @, leave the host empty, or enter the bare domain as Proton’s Namecheap guide does.
3. Create every address you will use on the domain before touching MX. Once MX points at Proton, mail to an address Proton does not know bounces, unless you set a catch-all under Domain names → Actions → Set catch-all.
4. Under Review → MX, add both MX records, then delete the old ones or give Proton’s the lowest priority number.
5. Add SPF, all three DKIM CNAMEs and DMARC from their tabs. Keep a single SPF record, merging any other sender’s include: into it.
6. Wait for the green check marks: a few minutes to several hours depending on your old TTL, per Proton, though some platforms hold old settings for one to three days.

Proton suggests p=quarantine for most domains. The staged path from p=none monitoring to p=quarantine and then p=reject, with the exact records and how to check each one is working, is in our SPF, DKIM, and DMARC guide.

What protonmail._domainkey is, and why there are three

protonmail._domainkey is the host name of the first of three DKIM CNAME records Proton asks for; the others are protonmail2._domainkey and protonmail3._domainkey. Because they point at keys Proton hosts, keys rotate without DNS edits: Proton generates a new 2048-bit key every six months, and the three records keep one key active while the others are retired and recreated.

Host and target are easy to swap. The host has an underscore (protonmail._domainkey); the target starts protonmail.domainkey. with a dot instead, then your domain’s ID and domains.proton.ch, as in this worked example. Paste the target into the host field and the record sits at a name no receiver looks up.

When the DKIM tab will not turn green

Proton’s CNAME troubleshooting page and registrar guides point to four causes:

• Not an exact match. Copy from Domain names → Review → DKIM rather than retyping.
• The trailing period. Some registrars reject a period at the end of a CNAME value; others require it. If yours rejects it, delete it. Gandi, for one, needs the trailing dot on MX hostnames.
• A leftover DKIM TXT record from manual key rotation. Delete it and add the CNAMEs at once, because DKIM stops signing in between.
• Cloudflare’s proxy. Set each CNAME to DNS only; Proton’s Cloudflare guide says a proxied record will not propagate.

Migrating from Gmail

If you’re moving from Gmail, you have a few options. The phased version of all of this, with a realistic timeline, is in our Gmail to encrypted-email migration plan.

Option 1: Fresh start. Set your Proton address as your new primary email. Start telling contacts about the change. Let the old Gmail account receive messages that you’re no longer actively monitoring. This is the cleanest approach long-term but requires the most transition effort.

Option 2: Proton’s Easy Switch. Proton has a migration tool under Settings → Easy Switch that can import email, contacts, and calendar from Gmail. You authorize it via OAuth — you don’t give Proton your Gmail password. The tool pulls messages over and stores them encrypted in Proton. Note that imported historical email gets encrypted at rest in Proton’s storage, but the import process means Proton temporarily has access to the plaintext — it’s a data migration, not E2EE retrospectively applied.

Option 3: Gmail forwarding. Set Gmail to forward incoming email to your Proton address. This is a transitional measure that maintains deliverability while you migrate. Turn it off once you’ve updated your address with contacts and services.

Practical Migration Tips

A realistic migration takes weeks or months, not an afternoon. Don’t try to close your Gmail immediately.

Start with the high-value accounts: banking, primary services, anything sensitive. These are the ones where the privacy improvement matters most.

Use a password manager during migration — you’ll be resetting passwords on dozens of accounts. This is also a good time to audit which services you even want to keep.

For mass email and newsletters, use something like SimpleLogin or Addy.io for disposable aliases that forward to your Proton address. This keeps your actual Proton address from becoming widely distributed. Our guide to setting up email aliases compares the alias services and covers the one-alias-per-service habit that makes them worth the setup.

What You’ve Got After Setup

A properly configured ProtonMail account gives you:

• E2EE for mail exchanged with other Proton users
• Swiss jurisdiction (Federal Data Protection Act, generally considered strong)
• No advertising-based revenue model
• No reading of your email content for targeting
• Recovery that requires your recovery phrase (which means they genuinely can’t help you if you lose it)

The remaining limitations: metadata (sender, recipient, timing) is visible to Proton; email to non-Proton users isn’t end-to-end encrypted unless you use password-protected messages; and Proton is still subject to legal orders from Swiss authorities.

For most people, this is a substantial improvement over Google or Microsoft email.

Related on this site

• How to Encrypt Email in Outlook: S/MIME, Purview, and IRM
• Email Security Threat Model: Who Reads Your Email?
• End to End Encrypted Email Explained: What Stays Private
• Proton Mail vs Gmail Privacy: Encryption and Data Access
• Tuta Setup Guide: Getting Started with Encrypted Email
• Thunderbird PGP Setup: Encrypt Email Without Add-Ons

FAQ

can proton mail host email for a domain that already has a website

Yes. Proton only needs TXT, MX and CNAME records, so the records that point your website at its host stay as they are, and the site keeps running wherever it lives. What moves is inbound mail: once the MX records point at Proton, the old mail host stops receiving, so create every address first.

can i buy a domain through proton mail

No. Proton says plainly that it is not a domain name registrar, so you register the domain elsewhere and connect it. Its registrar guide lists Porkbun, GoDaddy, Namecheap, Domain.com and Bluehost by popularity, and advises picking one that keeps your details out of public WHOIS and supports two-factor authentication, since whoever controls the DNS controls the mail.

what happens to my custom domain if i downgrade proton mail

A downgrade to Proton Free disables the custom domain, because Free does not include one. Proton’s orphaned-address rules then apply: addresses with no mail are deleted, and addresses that sent or received mail stop working but keep their keys, so old messages stay readable. Adding the domain back on a paid plan relinks them.

can i get a pm.me address on a free proton account

No. Activating a pm.me short address now requires a paid Proton Mail plan; free accounts used to get a receive-only version, but Proton has ended that. If you downgrade from a paid plan, an existing pm.me address becomes receive-only: mail sent to it still arrives, but you can no longer send from it.