SPF and DKIM by provider

GoDaddy DKIM, SPF and DMARC records

Last updated 2026-08-26

GoDaddy sends mail from its own email products, and hosts the DNS zone that other platforms' records land in. Here is what to publish so it can do that as your domain, and what has to line up before DMARC will pass.

GoDaddy SPF record: one record, merged includes

Add the include for the platform that sends. Most domains whose DNS sits at GoDaddy send their mail from somewhere else. include:secureserver.net is the value GoDaddy documents for Microsoft 365 from GoDaddy, for Professional Email and for mail sent from GoDaddy hosting:

That include authorises GoDaddy's own servers and Microsoft's. When Google Workspace, a Microsoft tenant you bought direct, or an ESP sends your mail, publish that platform's include and leave secureserver.net out.

Read the records already published before you add anything. GoDaddy writes the SPF record for you when the domain, the DNS and the email all sit in the same GoDaddy account. If you paste a second record in from your sending platform, the domain answers with two. RFC 7208 section 4.5 makes that a permerror, so DMARC then rests on DKIM alone. The GoDaddy panel still shows you two records that both read correctly. GoDaddy's SPF record page says so. Their wording: "Only one SPF record will work on your domain at a time and we're unable to provide guidance on custom SPF records." Merging every include into one record is your job. Edit the line that is already there, and add the other platform's include to it.

A GoDaddy SPF record goes in as a TXT record. The Type menu offers no SPF entry. GoDaddy's two help pages disagree about how long the Value can be: the SPF page allows 512 characters and the TXT record page allows 1024, both checked on 2026-08-20. An include-only record stays well under either.

When I last checked, secureserver.net published v=spf1 include:spf-0.secureserver.net -all, and spf-0.secureserver.net listed 33 ip4 blocks before including spf.protection.outlook.com. That include costs 3 of your 10 lookups before you list the helpdesk or the payroll system. The ip4 blocks do not count against the budget, but each nested include does. Suppose the domain already carries include:spf.protection.outlook.com for a tenant you bought direct from Microsoft. Microsoft's netblocks then appear twice, and the duplicate include costs one more of the 10.

Whatever you end up publishing, count the lookups afterwards. SPF allows ten DNS-querying mechanisms across the whole nested chain, and going over turns the record into a permerror that authorises nothing. The SPF checker resolves the chain and gives you the number.

GoDaddy DKIM: the Name field takes the prefix

The platform that signs your mail generates the key, and GoDaddy is where you paste the records it gives you. The Name field takes the prefix without your domain, because GoDaddy appends the domain itself. Type selector1._domainkey, and GoDaddy publishes selector1._domainkey.example.com. If the Name carries your domain as well, the panel still shows the record you typed, and the sending platform goes on reporting that record as missing.

Microsoft 365 from GoDaddy. The DKIM screen is not in GoDaddy's console. GoDaddy sends you to Microsoft's Defender portal, and your GoDaddy username and password do not work there.

1. Sign in at https://security.microsoft.com/dkimv2 with a Microsoft 365 email address and password. GoDaddy's page says you need admin permissions to create and add the records.
2. Create the keys for your domain, then copy the hostname and the value of both CNAME records.
3. Publish both in GoDaddy DNS as Type CNAME, one record per hostname.
4. Return to the portal and switch on "Sign messages for this domain with DKIM signatures".

Microsoft signs nothing for your domain until you press that switch, however correct the CNAMEs look. The Microsoft 365 page covers the rest of that tenant.

Microsoft 365 with Advanced Email Security. Proofpoint filtering changes the procedure, and GoDaddy documents it as a separate path. Contact a GoDaddy Guide first: GoDaddy has to give your account access to the Domains section of Advanced Email Security. Sign in to the Advanced Email Security page with your GoDaddy username and password. Select Sign in to Advanced Email Security, then sign in with Microsoft using the Microsoft 365 address. Under Administration, Account Management, Domains, pick the domain, then More options, Configure DKIM, then Create New DKIM Signing Key. The key arrives as one TXT record under a selector you can rename, so publish it in GoDaddy DNS with Type TXT. Then come back to Domains and select Verify DKIM Keypair, Verify Key.

Professional Email. GoDaddy documents two CNAME hosts here, secureserver1._domainkey and secureserver2._domainkey. The values come from the Email & Office Dashboard, under Manage next to your user, and so does the DMARC value that page tells you to publish.

Mail from GoDaddy hosting. cPanel writes the key itself. Under Email, Email Deliverability, Manage, it shows a suggested DKIM record as a TXT record, with the name and the value to copy. GoDaddy's TXT Value field accepts 1024 ASCII characters, so a 2048-bit key goes in as one line. Do not break it across lines to make it readable.

An ESP gives you either a pair of CNAME records or a TXT key under a selector it chose, and the Name rule above covers both.

Return path and SPF alignment

Most platforms that send as your domain put their own domain in the envelope sender, and SPF checks that domain. SPF then passes for the platform and fails alignment with yours, so DKIM is the check that carries DMARC. Several platforms close the gap by asking you to publish a bounce subdomain of your own, something like bounce.example.com, as a CNAME pointing into their infrastructure. That arrives as one more CNAME for GoDaddy's panel, and it is the record that puts your domain back in the envelope sender.

DMARC alignment with GoDaddy

DMARC passes when SPF or DKIM passes and the domain it authenticated matches the domain in your visible From address. A provider can pass both checks for its own domain and leave you failing. These are the GoDaddy specifics:

• GoDaddy requires the Name of a CNAME record to be "not already in use by another record", so a leftover TXT at selector1._domainkey from an earlier attempt blocks the CNAME until you delete it. That field also refuses @, which rules out a root-domain CNAME here.
• Records you edit in GoDaddy reach the internet only when the domain uses GoDaddy nameservers, which is the condition GoDaddy's DNS page states. Plenty of GoDaddy domains answer from Cloudflare or Route 53. Run dig +short NS example.com on your own domain before you spend an afternoon editing a zone that no resolver queries.
• GoDaddy's DMARC example for Microsoft 365 publishes p=quarantine at pct=100, with a rua= and a ruf= address. If you set p=quarantine before you know which senders align, receivers quarantine your own order confirmations. Publish p=none with a rua= address first, and read a few weeks of reports. RFC 7489 leaves failure reports to the receiver's discretion, and the rua= tag is the one that asks for aggregate reports.
• GoDaddy's hosting email page prints a DMARC value whose reporting address carries no scheme: rua=dmarc_rua@onsecureserver.net, as printed on 2026-08-20. RFC 7489 defines rua as a list of URIs and requires receivers to support mailto:, so publish rua=mailto:dmarc@example.com with your own address instead. If you paste that page's value as printed, p=quarantine applies to your mail and your reports go to a GoDaddy address instead of to you.

The GoDaddy DNS page shows the records you published, but it cannot show you what receivers did with the mail those records cover. That verdict arrives in DMARC aggregate reports, which receivers mail daily to whatever address the rua= tag names. GoDaddy does not collect those reports. Decide that address while the panel is open. The address goes in the rua= tag on the DMARC record you are already editing, and if you leave it out now, you edit the zone a second time.

Cloudflare's free DMARC Management charts those reports for domains whose DNS you move to Cloudflare, and Postmark's free DMARC Digests mails a weekly summary for a domain hosted anywhere, GoDaddy included.

DomainCanary is our product, so read this section knowing who wrote it. Most GoDaddy accounts hold more than one zone, and we watch up to 5 of those domains on Pro for $19 a month in one Monday email, a section each under an account summary. A settings checkbox skips a domain's digest on a clean week and records it on the dashboard instead, so 5 domains do not produce 5 no-news emails. Your first domain is free, and one digest across every zone you keep here comes with the paid plan. Aggregate reports name sending IPs rather than platforms, so the digest gives you an address and leaves the identification to you.

The general case is covered in alignment, explained, and the header you read to prove it is on the dmarc=fail page.

Verify it

Substitute your domain, and run these after the TTL on anything you replaced has expired:

Then send one message through GoDaddy to a Gmail address you control, open Show original, and look for dkim=pass with your domain in header.i. That single check is worth more than any number of DNS lookups, because it tests the thing receivers actually do.

The SPF checker gives you the lookup count, the DKIM checker confirms a selector resolves and the key is long enough, and the DMARC checker reads your policy back to you. All three are free and none of them ask for an account.

Values here were checked against GoDaddy's own documentation, at GoDaddy Help. Providers change DNS requirements without much announcement, so if their screen disagrees with this page, believe their screen and tell us.