diff --git a/mat.services.lua b/mat.services.lua
index 81e063c..a1a8c37 100644
--- a/mat.services.lua
+++ b/mat.services.lua
@@ -2,7 +2,7 @@
 -- _a = "mat.services"
 
 -- custom protonmail domain
-protonmail(_a, "6e777d2bb348043a8e73b4f405b6b2dc659ff85f")
+protonmail(_a, "6e777d2bb348043a8e73b4f405b6b2dc659ff85f", "dcwpz6gpldptg5vbdvvdztzgb7klx436m5hho3egx4mwmvh6kwvba")
 
 -- static site on netlify
 alias(_a, "apex-loadbalancer.netlify.com")
diff --git a/sloane.lol.lua b/sloane.lol.lua
index e15fe5e..2a4ffca 100644
--- a/sloane.lol.lua
+++ b/sloane.lol.lua
@@ -2,7 +2,7 @@
 -- _a = "sloane.lol"
 
 -- custom protonmail domain
-protonmail(_a, "94d73b00f6e91d68cad4f484a6698da51258732d")
+protonmail(_a, "94d73b00f6e91d68cad4f484a6698da51258732d", "dp6s3yhznlevwjjetfi3br7kfijwgxl7ixy4dzoal323n622jldpa")
 
 -- forgejo on fly
 aaaa("git", "2a09:8280:1::a:4caa")
diff --git a/sloane.page.lua b/sloane.page.lua
index c3b0f5c..78cdeda 100644
--- a/sloane.page.lua
+++ b/sloane.page.lua
@@ -2,7 +2,7 @@
 -- _a = "sloane.lol"
 
 -- custom protonmail domain
-protonmail(_a, "3cc98a4f2ce0d63b7ce519fe70419b2b2a5cee6f")
+protonmail(_a, "3cc98a4f2ce0d63b7ce519fe70419b2b2a5cee6f", "dxmkd56ygkv2n3mtqzoessrkmphqqgbqoxpbmys2z4ecyc5eemmxa")
 
 -- forgejo on fly
 aaaa("git", "2a09:8280:1::a:4caa")
diff --git a/templates.lua b/templates.lua
index 3654360..2e95180 100644
--- a/templates.lua
+++ b/templates.lua
@@ -1,4 +1,4 @@
-function protonmail(domain, verification)
+function protonmail(domain, verification, dkim)
   -- Configure mail records for protonmail
   
   -- Verification
@@ -12,9 +12,10 @@ function protonmail(domain, verification)
   txt(domain, "v=spf1 include:_spf.protonmail.ch mx ~all")
   
   -- DKIM
-  cname("protonmail._domainkey", "protonmail.domainkey.dcwpz6gpldptg5vbdvvdztzgb7klx436m5hho3egx4mwmvh6kwvba.domains.proton.ch.")
-  cname("protonmail2._domainkey", "protonmail2.domainkey.dcwpz6gpldptg5vbdvvdztzgb7klx436m5hho3egx4mwmvh6kwvba.domains.proton.ch.")
-  cname("protonmail3._domainkey", "protonmail3.domainkey.dcwpz6gpldptg5vbdvvdztzgb7klx436m5hho3egx4mwmvh6kwvba.domains.proton.ch.")
+  -- TODO: use concat()?
+  cname("protonmail._domainkey", "protonmail.domainkey." .. dkim .. ".domains.proton.ch.")
+  cname("protonmail2._domainkey", "protonmail2.domainkey." .. dkim .. ".domains.proton.ch.")
+  cname("protonmail3._domainkey", "protonmail3.domainkey." .. dkim .. ".domains.proton.ch.")
   
   -- DMARC
   txt("_dmarc", "v=DMARC1; p=quarantine")