Proton Mail + Cloudflare DNS

Scope / Objective

Dependencies / Preconditions

• Cloudflare zone: mtinfrasolutions.com active
• Proton Mail domain setup initiated and provides verification/auth records
• Permissions to edit Cloudflare DNS records

Change plan

1. Capture pre-change DNS state (Cloudflare UI + DoH JSON).
2. Apply Proton Mail records in Cloudflare DNS (TXT/MX/CNAME).
3. Validate external resolution and mail flow; confirm SPF/DKIM/DMARC via headers.
4. Capture evidence pack and hashes; document final state.

Implementation steps

1) Create/verify required DNS records (Cloudflare → DNS → Records)

2) Cloudflare UI verification

1. Open Cloudflare zone mtinfrasolutions.com → DNS → Records.
2. Confirm the Proton records exist exactly as provided.
3. Confirm there are no duplicate/conflicting SPF TXT records at @.

3) Optional: DMARC policy posture

Current DMARC policy is p=quarantine. Consider aligning long-term policy to organizational risk tolerance and reporting requirements (e.g., add rua= reporting address).

Validation (with exact commands)

A) DoH DNS checks (PowerShell)

$domain   = "mtinfrasolutions.com"
$BasePath = "$env:USERPROFILE\Documents\MTINFRA-EvidencePack"

# SPF TXT
$spf = Invoke-RestMethod -Uri ("https://cloudflare-dns.com/dns-query?name=$domain&type=TXT") -Headers @{ accept="application/dns-json" }
$spf | ConvertTo-Json -Depth 10 | Out-File (Join-Path $BasePath "EV-MAIL-10-TXT-Apex-DoH.json") -Encoding utf8

# MX
$mx = Invoke-RestMethod -Uri ("https://cloudflare-dns.com/dns-query?name=$domain&type=MX") -Headers @{ accept="application/dns-json" }
$mx | ConvertTo-Json -Depth 10 | Out-File (Join-Path $BasePath "EV-MAIL-11-MX-DoH.json") -Encoding utf8

# DMARC
$dmarc = Invoke-RestMethod -Uri ("https://cloudflare-dns.com/dns-query?name=_dmarc.$domain&type=TXT") -Headers @{ accept="application/dns-json" }
$dmarc | ConvertTo-Json -Depth 10 | Out-File (Join-Path $BasePath "EV-MAIL-12-DMARC-DoH.json") -Encoding utf8

# DKIM selectors
$dk1 = Invoke-RestMethod -Uri ("https://cloudflare-dns.com/dns-query?name=protonmail._domainkey.$domain&type=CNAME") -Headers @{ accept="application/dns-json" }
$dk1 | ConvertTo-Json -Depth 10 | Out-File (Join-Path $BasePath "EV-MAIL-13-DKIM1-DoH.json") -Encoding utf8

B) Mail flow + header authentication

1. Send a test email from an external mailbox to <your-proton-recipient>@mtinfrasolutions.com.
2. In Proton Mail, open message → view full headers/original.
3. Confirm Authentication-Results indicates:
   • SPF: pass
   • DKIM: pass
   • DMARC: pass/aligned
4. Save headers to a TXT file.

Rollback plan

1. Remove newly added Proton-related DNS records (only those introduced by the change).
2. Restore previous values from evidence pack (pre-change JSON/Cloudflare export).
3. Revalidate mail flow and authentication.

Evidence pack checklist

Final state