Provider setup

GoDaddy SPF, DKIM and DMARC: set up all three records

The GoDaddy SPF value, how DKIM works for Microsoft 365 from GoDaddy and cPanel hosting email, and a safe first DMARC record in GoDaddy DNS.

By Updated Last verified

On this page
  1. SPF on GoDaddy
  2. DKIM on GoDaddy
  3. DMARC on GoDaddy
  4. Check all three
  5. Sources

On GoDaddy DNS, SPF is a TXT record at @ with the value GoDaddy gives (opens in a new tab) for its email products, v=spf1 include:secureserver.net -all. For DKIM with Microsoft 365 from GoDaddy (opens in a new tab), you create keys in Microsoft's Defender Portal and add them as CNAME records. DMARC (opens in a new tab) is a TXT record named _dmarc, added after SPF and DKIM.

SPF on GoDaddy

An SPF (Sender Policy Framework) record is a TXT record (opens in a new tab) that helps identify which mail servers may send email for your domain. To add it in your GoDaddy account, your domain must use GoDaddy nameservers. Select Add New Record, choose TXT, and enter @ as the name to put the record on your root domain.

If you use Professional Email, Microsoft 365 from GoDaddy, Linux Hosting, Gen 4 VPS & Dedicated Hosting or Media Temple Mail, the value is:

v=spf1 include:secureserver.net -all

Checked against live DNS, secureserver.net itself publishes v=spf1 include:spf-0.secureserver.net -all.

GoDaddy's Microsoft 365 SPF article (opens in a new tab) adds:

  • If your domain, DNS and email are in the same GoDaddy account, GoDaddy adds the SPF record for you.
  • If you also send through other services, such as an email marketing tool, include them in the same record.
  • Your domain can only have one SPF record. A missing, incorrect or duplicate SPF record shows a banner in your Email & Office Dashboard.

The SPF standard also says a domain must not have multiple SPF records (opens in a new tab). To combine several senders into one record, use the SPF record generator; if the record gets long, see SPF too many DNS lookups.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

DKIM on GoDaddy

How you add DKIM depends on which GoDaddy email product you use.

Microsoft 365 from GoDaddy. GoDaddy's DKIM article (opens in a new tab) has three steps: create DKIM keys, add the records to your DNS, then enable DKIM.

  1. Sign in to the Microsoft 365 Defender Portal with your Microsoft 365 email address and password; your GoDaddy username and password won't work there. Create DKIM keys for your domain; the keys are generated as CNAME records.
  2. In GoDaddy DNS, add both records as CNAME records.
  3. Back in the Defender Portal, turn on the Sign messages for this domain with DKIM signatures toggle.

Allow up to 48 hours for the records to propagate. Microsoft 365 sets up DKIM automatically for the initial onmicrosoft.com domain, but you repeat these steps for each other domain. For the Microsoft side in more detail, see Microsoft 365 SPF, DKIM and DMARC.

GoDaddy VPS hosting email (cPanel). GoDaddy's hosting article (opens in a new tab) has you find the record in cPanel: under Email, select Email Deliverability, select Manage next to your domain, and copy the name and value of the suggested DKIM TXT record into GoDaddy DNS.

If signatures fail after setup, see DKIM fail.

DMARC on GoDaddy

GoDaddy's DMARC article (opens in a new tab) requires SPF and DKIM before DMARC and has you add a TXT record with the name _dmarc. It marks p=quarantine as recommended and uses it in its steps, with pct=100 and a ruf address in its example value.

RFC 9989 (opens in a new tab) describes a different order: domain owners usually start with p=none and a rua address, and legitimate mail streams that fail must be fixed before enforcement (opens in a new tab). Two parts of GoDaddy's example can also go: RFC 9989 lists pct as historic (opens in a new tab), meaning deprecated, and RFC 9991 (opens in a new tab) notes that many large providers limit or disable failure reports, which a ruf address (opens in a new tab) requests. This is the monitoring record the DMARC record generator builds:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Replace the address with a mailbox you control. Move to quarantine and reject once your reports show your real senders pass; see DMARC policy not enabled for that step.

Check all three

The check is a free one-off check of your SPF, DKIM and DMARC records. It only reads public DNS, and nothing is changed and no email is sent.

Sources

Tools for this

Frequently asked questions

What is GoDaddy's SPF record?

For Professional Email, Microsoft 365 from GoDaddy and GoDaddy hosting email, GoDaddy gives the value v=spf1 include:secureserver.net -all, added as a TXT record at @. Your domain can only have one SPF record.

Does GoDaddy set up DKIM for me?

For Microsoft 365 from GoDaddy you create DKIM keys in the Microsoft 365 Defender Portal, add them as two CNAME records in GoDaddy DNS, then turn on DKIM signing. On cPanel hosting, cPanel shows a suggested DKIM TXT record to add.

What DMARC policy should I start with on GoDaddy?

Domain owners usually start with p=none and a rua reporting address, then enforce once reports show their real senders pass. GoDaddy's own steps start at p=quarantine instead.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account