Better to use silicon diodes for D1 and D2 rather than schottkies, on leakage grounds. I know their Vf is larger, on paper probably exceeding the maximum mux input voltage, but their leakage will be orders of magnitude lower. Some silicon diodes are advertised as low leakage. However, there's little point in striving for a leakage lower than your mux will provide. Note that both diode and mux leakage currents tend to increase exponentially with temperature, sometimes a horrible looking data sheet figure for worst case at temperature will be OK if you will only be using your system at ambient.
Use a resistor between the diode clamp and the mux input to limit the current into the muxes protection diodes, once D1 or D2 are clamping.
Not all multiplexers are equal, some have robust input protection as they're designed for this type of use. Some specify their input protection didoes can tolerate a high current. Do a wide search and read the data sheets carefully.
Do not assume leakage currents will cancel. Leakage is an uncontrolled parameter.
Don't forget to use an adequate voltage rating for R3, your common or garden resistor is usually only good for 200v. Use several in series, or one rated for a much higher voltage, they're not too expensive. Spikes of 1500v are common on mains.
Something like PUSB2X4Y has pulse specifications in the amps. If it can take a microseconds pulse of 4.5A at typically 3.8v across it, then you can assume it will take 10s of mA all day, every day, without embarrassment.
In case you haven't spotted Matthew's comment below, here is what I think he was suggesting, in the left-hand diagram, back to back diodes across a buffer op-amp.
simulate this circuit – Schematic created using CircuitLab
Although the op-amp output could be thought of as more current-capable than the inputs, it still has substrate diodes and a maximum current specification, so is also in need of protection itself. Some amplifiers even have inputs specified to well outside the rail for input protection, but only 0.3v overvoltage and weedy current spec on the output pin.
Going on from that basic idea, my take on the principle is shown on the right. The diode string D3-6 provides voltage clamping to 'a little outside' the rails, R2 protects the diodes, R4 protects the amplifier input, R3 protects the amplifier output and bootstraps the voltage across diodes D4 and D5 so that their leakage to the input is minimal. With such bootstrapping, the diodes could be almost anything, even big rufty-tufty bomb-proof rectifiers.
The two diodes in series suggests that care is needed in layout if protection is to extend to fast pulses. Consider the SOT-23 BAV99, two series diodes in one package, to implement the pair D3,4 and the pair D5,6. They are specified continuous >100mA, typical 10mS pulse 800mA, which for any reasonable R2 sounds adequate. BAT754S is an alternative in schottky. Similar currents, but much lower clamping voltage.
You do not actually need an op-amp per channel if your multiplexer leakage is low enough. The circuit at the bottom shows the single buffer following the mux driving all of the input protection diodes. Note that the multiplexer leakage appears at the amplifier input, whereas using a per-channel buffer eliminates mux leakage.
The 'on' channel is receiving the correct bootstrap voltage. The 'off' channels will probably be getting the wrong voltage, and the 'inner' protection diodes may well conduct. This is not a measurement problem, as the channel we want is correct. It may, or may not, be a problem to what is driving those inputs, to have our nominally high impedance inputs yanked off to a different voltage. If we assume it's a very feeble current source (we are concerned about leakage, so we know it's not a low impedance source) with a large capacitance to ground, it may take a long time after selecting that input before the voltage has returned to its correct value.
Actual leakage measurements for diodes at 15C.
diode -2/-5v leakage slope resistance over +/- 10mV
----- -------------- ------------------------------
1N4148 4nA 30Mohm
BAT42 35nA 1Mohm
BAS116 <10pA (30v) >>20Gohm
The BAS116 conduction continued as 40pA 300mV, 45nA 450mV, 16uA 640mV. The BAS116 typ/max spec at 25C is 3pA/5nA, and 3n/80n at 150C.
That means, at that temperature, and making the assumptions of reverse leakage varying by a factor of 2 up and down, and 3mV voltage follower offset, you could assume the following leakage
diode no bootstrap bootstrapped
----- ------------ ------------
1N4148 6nA 1pA
BAT54 50nA 3nA
BAS116 <10pA <<10pA
I made those measurements with a £8 meter with 10M input resistance and a 200mV range, so 10pA per LSB, not difficult (obviously can't tell the difference between 0 and 10pA!). I suggest you do the same with your chosen diodes and at higher temperatures.
Best Answer
When advanced low Vdd CMOS uses RdsOn of 25 Ohms at 3.3V with 0.2 to 2 ns rise times, designers often are unaware of need to have controlled impedance tracks and results in ringing at half wavelength of track length.
low power Schottky diodes with small capacitance are sometimes used to provide a dynamic load impedance of around this driver impedance range to at least provide some matched load to the overshoot.
when the transmission line is mostly inductive from poor coupling to gnd tracks or gnd plane near same gap as track width, and with CMOS input Z can be x pF and 1GOhm, ringing and UNDERSHOOT can cause glitches.
analogy
The clamp diodes are like a stiffer rubber end stop to a spring (inductive track) with a weak shock absorber in zero gravity going over a pot hole and the car still bottoms out and then jumps up but with less bouncing shock waves. A properly tuned shock absorber is like a properly tuned transmission line to give controlled step response with minimal overshoot/undershoot and ringing.
No overshoot is a theoretical perfect transmission line matched to between source and terminator which is as I said above can be 25 ohms -/+50% with temp and 10% supply variation. so often terminated with 50 Ohms. with tracks matching the load. But skin effects and dynamic dielectric constant reduction >1Ghz causes some imperfections .
A diode is a poor man's choice for lack of impedance controlled on track layout and design,pick any; coplanar, stripline, microstrip! for 50 Ohm single ended and 100 Ohm differential.