| Proton Mail | |
|---|---|
| Domains | proton.me, protonmail.com, protonmail.ch, pm.me |
| Mail routing | mail.protonmail.ch and mailsec.protonmail.ch, which serve every Proton domain including the shorter pm.me aliases. |
| What we can resolve | We resolve few mailboxes here |
How Proton Mail answers a probe
What the server does when we open a connection and ask about one address.
- Public reports about RCPT TO on Proton disagree: some describe a positive reply for every local part, others a plain rejection for unknown ones. Proton documents neither, and we won't state as fact a behavior we haven't measured and published.
- Rate limiting is firm and the service drops connections that probe repeatedly from one address.
- Paid Proton accounts can attach custom domains, which then carry Proton MX records and behave the same way.
- SimpleLogin, which Proton owns, issues forwarding aliases on domains such as simplelogin.io and 8shield.net, and those are separate addresses that can be disabled independently.
The part that catches people out
What we do about it
We report what the server said, and the mx_host on the row shows it was Proton's. If a random local part is accepted, the result is catch_all, a finding about the whole domain that costs a credit like any other result. If the connection is limited or dropped, the result is unknown and isn't billed. Seeing the host matters: a bare label makes it look like a misconfigured company, when it is a privacy service working as designed.
Sending to Proton Mail mailboxes
Verification is one step. These are the things that decide whether the message lands.
- Proton users are unusually likely to have chosen the service specifically to avoid marketing mail. Consent quality matters more here than anywhere else on your list.
- Proton strips tracking pixels for many users, so opens under-report rather than over-report.
- A cold list with a heavy Proton share is worth a second look at sourcing. People do not hand these addresses to data brokers by accident.
jane@protonmail.com and jane@proton.me
Say your CRM holds jane@protonmail.com from 2019 and jane@proton.me from a form fill last month. Proton reserves a username across its own domains, so nobody else could have taken the second one. People who signed up in the protonmail.com years can switch on the matching proton.me address, and paid users can add the short pm.me form. If the local parts match, treat the rows as one person until something says otherwise.
Plus tags work here as well, so jane+shop@proton.me lands in jane's inbox. Fold those before you count subscribers, or one careful person shows up as five. None of this needs a probe, which is convenient at a provider where probing tells you so little.
Custom domains, and the one test a send can run
Paid Proton plans can host your prospect's own domain, and you'll only know by looking at the MX record. Those plans also offer a catch-all address as a feature, so a small firm on Proton may accept mail for every local part on purpose. Label the domain by what the MX says, and don't read the company's size or seriousness into an accept-all result.
For signups, confirmation is the honest substitute for verification. Send one message with a confirm link and treat the click as the verdict. It costs you a step in the funnel, and it's the only test this audience can't pass by accident. For cold lists there's no equivalent shortcut. Keep Proton rows in their own segment, mail them slowly, and let replies decide who stays. When you report on that list, show the Proton rows as unresolved instead of folding them into a clean-looking total, because whoever reads the report next will plan a send around that number.
Questions people ask
Can any verifier confirm a Proton Mail address?
Not with confidence that we can vouch for today. Proton doesn't document how it answers recipient probes, so treat a confident verdict on a proton.me address with care and ask the vendor whether it came from the server or from inference.
Should I remove Proton addresses from my list?
No. They are frequently real and frequently engaged. Treat them as unverifiable, keep them out of your accuracy expectations, and judge them by whether they reply.
What about SimpleLogin aliases?
They forward into a real mailbox and can be switched off at any time, so validity is temporary in the same way Apple's relay addresses are. We flag the domain rather than guessing at the destination.