How to set up SPF, DKIM and DMARC on GoDaddy

Three records, all added in the same place: Domain Portfolio → your domain → DNS → Add New Record. SPF is one TXT record on your root domain, DKIM is usually two CNAME records whose values are generated for your mailbox — you copy them, you never invent them — and DMARC is one TXT record named _dmarc. Budget 15 minutes at the keyboard. GoDaddy says most changes take effect within an hour, and up to 48 hours worldwide.

These three settings let receiving mail servers check that a message claiming to be from you really is from you. They do not guarantee your email reaches the inbox — your content and your sending reputation matter at least as much — but without them, anyone can send email in your name.

What we don't do: we never touch your DNS zone. This guide tells you what to type and where. You're the one who saves it, in your own account, with your own credentials.

Before anything else: is your DNS actually at GoDaddy?

This is the question that saves an hour of debugging, and almost no tutorial asks it.

GoDaddy sells you a domain, but that doesn't mean GoDaddy answers DNS questions about it. If you've ever pointed your domain at Cloudflare, at a web host, or at a site builder, your nameservers now point somewhere else — and the DNS page inside your GoDaddy account is still editable, still looks perfectly normal, and nobody on the internet is reading it.

Check your nameservers first. If they don't belong to GoDaddy, add your records wherever they do point — the values in this guide stay exactly the same, only the click path changes.

The records to copy and paste

1. SPF — who is allowed to send as you

What you must replace: possibly the whole thing. The value above is the one GoDaddy publishes for its own email products — Professional Email, Microsoft 365 from GoDaddy, Linux Hosting, Gen 4 VPS & Dedicated Hosting, and Media Temple Mail. If your mailboxes are somewhere else, that include: is wrong for you. Use the one your mail provider gives you:

If several services send on your behalf, they all go in one single line:

v=spf1 include:secureserver.net include:_spf.google.com -all

⚠️ One SPF record per domain. Always. Two v=spf1 lines don't mean double protection, they mean no SPF at all. GoDaddy states it plainly: "Only one SPF record will work on your domain at a time." So when you add a new sending tool, you edit the line you already have — you don't create a second one.

A word about that -all at the end. GoDaddy's default ends in -all ("reject anything not on this list"), while OVH, IONOS, Hostinger and Cloudflare all recommend ~all ("treat anything not on this list as suspicious"). Neither is wrong. -all is stricter and protects you better; ~all is more forgiving the day you plug in a new tool and forget to add it. If you're not sure, ~all while you're setting things up and -all once your DMARC reports are clean is a sane path. One thing that is not true, and that you'll read everywhere: DMARC does not "forgive" a ~all. As far as DMARC is concerned, ~all and -all are the same SPF failure — what saves the message is an aligned DKIM signature.

There's one more thing worth knowing, and it's the reason this page exists. GoDaddy's own help article says, word for word: "we're unable to provide guidance on custom SPF records." So the moment you use anything beyond GoDaddy's own email — which is almost everyone — you're on your own. That's the gap this guide fills.

2. DKIM — the signature on your messages

GoDaddy does not generate your DKIM key. Your mail service does, and the format depends on which one you use.

If you use GoDaddy Professional Email (powered by Titan) — two CNAME records:

What you must replace: both values. Only the two names are fixed; the targets are generated for your account and are displayed in your dashboard. A value copied from a tutorial will never work.

If you use Microsoft 365 from GoDaddy — also two CNAME records, but both the name and the value are generated in the Microsoft Defender portal, and you copy them from there. GoDaddy's own instructions say exactly that. If your plan includes Advanced Email Security, the records are TXT instead of CNAME, with a name starting with selector.

⚠️ Never trust a tutorial that gives you a ready-made Microsoft 365 DKIM value. Since May 2025, Microsoft uses a new CNAME format for custom domains added after that date, and part of the value is assigned dynamically — it is genuinely impossible to guess. Any page handing you selector1-yourdomain._domainkey.yourtenant.onmicrosoft.com as the value is wrong for every recent domain. Copy what your own screen shows you.

If your email is somewhere else — Google Workspace gives you a single TXT record; most campaign tools give you one to three records, TXT or CNAME depending on the tool. Same rule every time: copy what your screen shows.

If your DKIM value is very long and GoDaddy refuses it: a 2048-bit key runs past 255 characters, and DNS splits long text values into quoted chunks — "first part" "second part". That's not a GoDaddy quirk, it's how the DNS protocol works, and the checking server glues the pieces back together. Don't delete the quotes by hand.

3. DMARC — the instruction you give to inboxes

First, check whether GoDaddy already did it for you — because since April 2025, it does. If your domain uses one of GoDaddy's email services, GoDaddy automatically publishes a DMARC record on it:

v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;

Read that line carefully, because it changes your diagnosis twice over. One: your domain already answers "DMARC: configured" to any checker — at p=quarantine, a policy with real teeth — even though you never chose it. Two: look at the rua=. The reports about your domain go to GoDaddy, not to you. A domain can sit there for years looking perfectly compliant while its owner has never seen a single report. So before adding anything, look for an existing _dmarc record. If it's there, edit it — keep or adjust the policy, and put a report address you actually read in the rua= (you can list several addresses, separated by commas, if you want GoDaddy to keep receiving its copy). Whether this auto-created record also appears when your domain's DNS is hosted outside GoDaddy isn't documented.

If there's no DMARC record yet, here's the one to add:

What you must replace: YOU@YOUR-DOMAIN.com with an address you actually read. That's where your reports will land, and a DMARC record without a rua= is a report you'll never see.

Why p=none first. It means "watch and tell me". Nobody gets blocked, nothing changes for your recipients, and you start receiving the list of everything sending in your name — including the tools you'd forgotten about. You watch for two to four weeks, confirm every legitimate sender is recognised, and only then tighten one notch to p=quarantine, then p=reject.

⚠️ One DMARC record per domain too. If you already have one — including the auto-created one above — you edit it. You don't add a second.

Worth knowing before you go looking: GoDaddy has no generic, provider-neutral DMARC guide. What it does have is product-scoped — one DMARC article for Microsoft 365 from GoDaddy, one for its hosting products, one inside the Professional Email setup guide, plus a conceptual "what is DMARC" explainer. Nothing at all for Google Workspace or third-party senders. If your email isn't a GoDaddy product, nothing in GoDaddy's help tells you what to publish. That's the gap this section fills.

The click path

1. Sign in to your GoDaddy Domain Portfolio.
2. Select the individual domain you want to change. This opens its Domain Settings page.
3. Select the DNS tab to see your DNS records.
4. Select Add New Record, then pick the type — TXT or CNAME — from the Type menu.
5. Fill in Name, then Value, then TTL.
6. Select Save. If you're adding several records at once, use Save All Records.

The Name field wants the prefix only. GoDaddy defines it as "the hostname or prefix of the record, without the domain name. Enter @ to put the record on your root domain, or enter a prefix, such as mail." So type @ for SPF, _dmarc for DMARC, secureserver1._domainkey for DKIM — never _dmarc.yourdomain.com.

Two limits to keep in mind: a TXT value maxes out at 1024 characters and must be ASCII only; the Name field allows periods but not as the first or last character, and not two in a row.

If your domain has Domain Protection turned on, GoDaddy will ask you to verify your identity before saving — a 2-step verification code, an authenticator app, or a one-time password sent to your account email. Have your phone nearby; it's not an error.

The 3 mistakes we see most often on GoDaddy

1. Editing a zone nobody reads

You add the three records, everything saves cleanly, and nothing happens — your mail provider never validates, your scan never changes. Nine times out of ten, your nameservers point somewhere other than GoDaddy, and the DNS page you just edited is a leftover copy that no resolver ever queries.

How you spot it: your records look perfect in the GoDaddy panel, but any outside lookup of your domain shows different records — or none at all.

The fix: find out where your nameservers point, and add the records there instead. Same values, different panel. And once you've found it, that's your real DNS home from now on.

2. A second SPF record for the new tool

You sign up for a newsletter tool, it asks for include:something.com, and you dutifully create a new TXT record. Now your domain has two v=spf1 lines, and SPF stops working entirely — not just for the new tool, for your normal mailboxes too.

GoDaddy's default -all makes this worse than elsewhere. With -all, a sender that isn't listed is a hard fail rather than a soft one, so the day your SPF breaks, it breaks loudly.

How you spot it: a scan reports "multiple SPF records", or your DMARC reports show SPF in permerror while each individual line looks fine. Some recipients accept you, others don't, with no obvious pattern.

The fix: one line, all the include: values inside it. Delete the extras — don't leave them "just in case".

3. Typing the full hostname in the Name field

You copy secureserver1._domainkey.yourdomain.com from your dashboard — that's genuinely what it shows — and paste it into GoDaddy's Name field. GoDaddy appends your domain, and you end up with secureserver1._domainkey.yourdomain.com.yourdomain.com, which exists for nobody.

How you spot it: your domain name appears twice in the record list. Your provider keeps saying the record isn't found, no matter how many times you re-copy the value.

The fix: edit the record and keep the left-hand part only: secureserver1._domainkey.

⚠️ Don't mix this up with its opposite. At some registrars (OVH, Gandi), the symmetrical trap sits on the CNAME target, where you have to add a trailing dot. Here you have to shorten the name. Same look, opposite fixes — which is exactly why people get caught by both.

How long before it takes effect

• In your GoDaddy account: saved immediately.
• On the internet: GoDaddy's own wording is "most DNS updates take effect within an hour but could take up to 48 hours to update globally."
• The old value can stay cached for as long as the TTL you had set before the change. With GoDaddy's 1 hour default, that's an hour — not painful, but real.
• For your provider's "Verify" button: wait an hour before clicking, then wait again. Clicking twelve times in five minutes only adds doubt.
• For DMARC reports: the first ones arrive 24 to 72 hours after you publish the record, then roughly once a day.

Next steps

• Set up Google Workspace email authentication on GoDaddy
• Set up Microsoft 365 email authentication on GoDaddy
• How to set up SPF, DKIM and DMARC on Namecheap
• How to set up SPF, DKIM and DMARC on Cloudflare
• How to move your DMARC policy to p=reject safely
• My emails go to spam even though SPF, DKIM and DMARC pass