protonmail.com

Observed 2026-07-15T08:55:05.951Z (2d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now

Runs onCloudflare

Email byProtonMail

Registered withMarkMonitor Inc.

Also usesGoogle Search Console

6 subdomains · email_comms

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat protonmail.com actually stands on - every host below is a signed observation

protonmail.com

A / AAAA

185.70.42.12

Cloudflareserves the site

ns1.protonmail.comns3.protonmail.comns2.protonmail.com

protonmail.comanswers its DNS

mailsec.protonmail.chmail.protonmail.ch

ProtonMailreceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://proton.me/mail

HTTP status301

Servercloudflare

TLS protocolHTTP/2

TLS issuernot observed

Behind Cloudflareyes

Response time825 ms

DNS resolutionNOERROR

Redirect chain

https://proton.me/mail

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

185.70.42.12

MX 2

10mailsec.protonmail.ch
5mail.protonmail.ch

TXT 11

google-site-verification=aq9zJnp3H3bNE0Y4D4rH5I5Dhj8VMaLYx0uQ7Rozfgg
google-site-verification=RVUCKIFDkg-Spau8kEohQRsgyHEBUQcVehZqF6PAQcQ
ahrefs-site-verification_4bdac6bbaa81e0d591d7c0f3ef238905c0521b69bf3d74e64d3775bcb2743afd
v=spf1 include:_spf.protonmail.ch ~all
google-site-verification=uXVNQLivTppnZssXHtMY7QVn70Mpd0x2U8pKj324Krk
mailru-verification: 14505c6eb222c847
yandex-verification: 6059b187e78de544
brave-ledger-verification=66a7f27fb99949cc0c564ab98efcc58ea1bac3e97eb557c782ab2d44b49aefd7
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;
v=STSv1; id=190906205100Z;

NS 3

ns1.protonmail.com
ns3.protonmail.com
ns2.protonmail.com

SOA 1

ns1.protonmail.com support.protonmail.ch

CAA 4

issue digicert.com
issue sectigo.com
iodef mailto:security@proton.me
issue letsencrypt.org

TLS Certificates (0)

None.

Subdomains (6)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for protonmail.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/protonmail.com">
  <img src="https://domaindrift.io/badge/protonmail.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for protonmail.com">
</a>

Ed25519 Receipt

Receipt ID: 2676ac2b-1a11-4118-8618-b6e619609156
Output Hash: 785c314f6315178e09851f31b21f568d589fa0bf1cd632b1a53b89325509c4e6
Signature: ed25519:719b82d4c4f6e3ca22fb44c6dd5549821ed3dfa538fe5c228477a6c8484a348c8827b379fb34c951f312ea4f755a777178856a4c9d855af9a1cf72a46470b702
Public Key: ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/protonmail.com