Proton Mail Custom Domain Setup: Look Professional Without Sacrificing Privacy

Bottom line upfront: You can send and receive email from you@yourdomain.com through Proton Mail in about 30 minutes. Your messages stay end-to-end encrypted. Recruiters see a polished professional address. Proton never reads your mail. That's the entire value proposition — here's exactly how to execute it.

Using a free Gmail or Yahoo address on a resume signals that you didn't bother to set up proper infrastructure. Using a custom domain on Proton signals you care about both professionalism and privacy. For anyone in tech, security, or any field where personal brand matters, this is a $36/year decision that punches far above its weight.

Last updated: 2026-06-15

What You Need Before You Start

You need three things in place before touching a single DNS record:

A registered domain — something like jasonwarren.dev or yourname.pro. If you don't have one yet, Namecheap or Porkbun are solid choices with reasonable privacy defaults.
A Proton Mail Plus plan or higher — the free tier doesn't support custom domains. Proton Mail Plus runs $3.99/month billed annually.
Access to your domain's DNS settings — log into wherever your domain is registered and find the DNS management panel.

That's it. No server to provision. No mail transfer agent to configure. Proton handles all the mail infrastructure; you're just pointing DNS records at it.

Step 1: Add Your Domain to Proton Mail

Log into mail.proton.me and navigate to Settings → All Settings → Custom domains. Click Add domain.

Type your domain name exactly as registered — yourdomain.com, not www.yourdomain.com. Proton will run a quick check and then give you a verification record to prove you own the domain.

The verification record looks like this:

```

Type: TXT

Host: @

Value: protonmail-verification=xxxxxxxxxxxxxxxxxxxx

TTL: 3600

```

Add this TXT record in your registrar's DNS panel. The exact interface varies by registrar, but you're always looking for a "DNS Records" or "Advanced DNS" section. Paste the value exactly — no trailing spaces, no quotation marks.

DNS propagation can take anywhere from 2 minutes to 48 hours, though most modern registrars push changes in under 15 minutes. Once Proton detects the TXT record, the domain moves to the next step automatically.

Step 2: Configure MX Records (The Critical Part)

MX records tell the internet where to deliver mail addressed to your domain. Get these wrong and mail silently disappears. Get them right and it just works.

Delete any existing MX records for your domain first — especially if your registrar added default ones. Then add Proton's two MX records:

```

Type: MX

Host: @

Value: mail.protonmail.ch

Priority: 10

TTL: 3600

Type: MX

Host: @

Value: mailsec.protonmail.ch

Priority: 20

TTL: 3600

```

The priority numbers matter — lower number = higher priority. Proton's primary server gets 10, the backup gets 20. Most DNS panels have a "Priority" or "MX Priority" field separate from the value.

Common mistake: Leaving a registrar's default MX record (often something like mail.namecheap.com) alongside Proton's records. Two competing MX records at the same priority cause unpredictable delivery. Delete the old ones entirely.

Step 3: Add SPF, DKIM, and DMARC Records

These three records are non-negotiable if you're sending email to recruiters. Without them, your messages from a custom domain hit spam folders. With them, you're a verified, trusted sender.

SPF — declares which servers are allowed to send mail from your domain:

```

Type: TXT

Host: @

Value: v=spf1 include:_spf.protonmail.ch ~all

TTL: 3600

```

DKIM — cryptographically signs your outgoing messages. Proton provides three CNAME records:

```

Type: CNAME

Host: protonmail._domainkey

Value: protonmail.domainkey.{unique-value}.domains.proton.ch

Type: CNAME

Host: protonmail2._domainkey

Value: protonmail2.domainkey.{unique-value}.domains.proton.ch

Type: CNAME

Host: protonmail3._domainkey

Value: protonmail3.domainkey.{unique-value}.domains.proton.ch

```

The {unique-value} portion is unique to your account — copy it directly from the Proton setup wizard, don't retype it.

DMARC — tells receiving servers what to do with messages that fail SPF/DKIM checks:

```

Type: TXT

Host: _dmarc

Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

TTL: 3600

```

Start with p=quarantine rather than p=reject until you've confirmed legitimate mail is passing. You can tighten to p=reject after a week of clean operation.

Step 4: Create Your Address and Test

Back in Proton's custom domain settings, click Add address once your DNS records show as verified. You can create you@yourdomain.com or any variation — hello@, contact@, firstname.lastname@.

For a job search, use your actual name. jason.warren@jasonwarren.dev reads as deliberate and professional. Avoid anything creative that makes recruiters wonder if you're serious.

Send a test immediately. Email yourself from a Gmail or Outlook account and confirm delivery. Reply from Proton to that external address and verify the reply shows your custom domain in the From field — not a @proton.me address. If you see @proton.me in outbound mail, revisit your address configuration in settings.

Step 5: Set Up Proton Bridge for Desktop Mail Clients

If you use a desktop email client — Thunderbird, Apple Mail, Outlook — Proton Bridge is what makes this work. It runs locally on your machine, handles decryption, and presents Proton Mail as a standard IMAP/SMTP account to your client.

Download and install Proton Bridge from proton.me/mail/bridge. It's available for Windows, macOS, and Linux.

On first launch, log in with your Proton credentials. Bridge will generate local IMAP and SMTP credentials — these are different from your Proton password. Keep the Bridge app running in the background (it sits in your system tray).

Configure your email client with these settings:

```

Incoming (IMAP):

Server: 127.0.0.1

Port: 1143

Security: STARTTLS

Username: your@yourdomain.com

Password: [Bridge-generated password]

Outgoing (SMTP):

Server: 127.0.0.1

Port: 1025

Security: STARTTLS

Username: your@yourdomain.com

Password: [Bridge-generated password]

```

The Bridge password is found in the Bridge app under your account — click the three dots next to your account name. It's a long random string, not your Proton login password.

For Apple Mail on macOS: Go to System Settings → Internet Accounts → Add Account → Other Mail Account. Paste the Bridge credentials. macOS may warn about an unverified certificate — this is expected since the connection is local (127.0.0.1) and the traffic never leaves your machine unencrypted.

The Privacy Picture: What Proton Actually Protects

Custom domain + Proton Mail gives you end-to-end encryption for messages between Proton users. For messages to Gmail, Outlook, and other non-Proton addresses (i.e., most recruiters), Proton encrypts in transit (TLS) but the receiving server decrypts on arrival. This is still meaningfully better than a standard Gmail inbox — Proton cannot read your stored messages, your inbox isn't mined for ad targeting, and your metadata is substantially less exposed.

For recruiter correspondence, this is the right trade-off. You're not exchanging nuclear secrets — you're job hunting. The professional custom domain and reduced corporate surveillance are the wins here.

If you're emailing other Proton users, you get full zero-knowledge encryption. Worth noting if colleagues or collaborators are also privacy-conscious.

Proton Mail Plus — $3.99/month gives you 1 custom domain, 10 email addresses, 15 GB storage, and Proton VPN access. Proton Unlimited at $9.99/month covers 3 custom domains if you want separate addresses for different professional contexts.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

Troubleshooting Common Issues

Mail bouncing with "550 5.7.1" errors — your MX records haven't fully propagated, or an old MX record is still in place. Use MXToolbox to check what the public internet sees for your domain. Wait 30 minutes and check again.

DKIM verification failing in Proton — CNAME records take longer to propagate than TXT records. Give it up to 2 hours. Also confirm there are no typos in the CNAME host values — protonmail._domainkey not protonmail.domainkey.

Bridge isn't connecting — check that Bridge is actually running (system tray icon). Restart it if needed. Also verify your client is set to 127.0.0.1 not localhost — some clients resolve localhost to IPv6 (::1) which Bridge doesn't always accept.

Sent mail shows wrong From address — in Proton web settings, confirm your custom domain address is set as the default send-from address under Settings → Addresses.

The 30-Minute Checklist

[ ] Proton paid plan active
[ ] Domain registered and DNS panel accessible
[ ] Verification TXT record added and confirmed
[ ] MX records (priority 10 and 20) added, old MX records deleted
[ ] SPF TXT record added
[ ] DKIM CNAME records (all three) added
[ ] DMARC TXT record added
[ ] Custom address created in Proton settings
[ ] Test send and reply confirmed working
[ ] Proton Bridge installed (if using desktop client)
[ ] Desktop client configured with Bridge IMAP/SMTP settings

That's the complete setup. Your custom domain email is encrypted at rest, carries proper authentication records, and gives any recruiter or hiring manager exactly the professional signal you want — without handing your job search activity to Google.

Start Getting Recruiter Responses With a Professional Inbox

A custom domain is the foundation, but your email signature, follow-up cadence, and how you present across platforms matter just as much.

Subscribe to the PrivateAI newsletter for tools and tactics that keep your professional presence sharp without trading your data for convenience.

[Get the PrivateAI Newsletter →] (email capture)

```