Where do I add these records in GoDaddy?

Sign in to GoDaddy and open My Products, then find your domain and click DNS (sometimes labelled Manage DNS). That opens the DNS records table for your domain, where every SPF, DKIM and DMARC entry lives. Use the Add New Record button, choose the record type your provider specifies — TXT for SPF and DMARC, usually CNAME or TXT for DKIM — and fill in the Name (host) and Value fields. This DNS manager only appears for domains whose nameservers point at GoDaddy; if you have moved DNS to Cloudflare, Route 53 or another host, you must add the records there instead. The domain registration staying at GoDaddy does not matter — what matters is which provider answers DNS queries for the domain.

Why isn't my SPF or DKIM working after I added it?

Three causes account for almost every failure. First, the host field: GoDaddy auto-appends your domain, so entering the full domain produces a double-appended record like _dmarc.example.com.example.com that nothing can find — use @ or the bare host label instead. Second, duplicate SPF: a domain may have only one SPF record, and a second one silently breaks both, so merge new senders into the existing record rather than adding another. Third, timing: DNS changes can take up to 48 hours to propagate, though most appear within an hour. Also confirm you finished the provider side of DKIM — publishing the key in DNS does nothing until you click Start authentication (or its equivalent) so the provider actually begins signing outgoing mail with that selector.

Does GoDaddy email (Microsoft 365 from GoDaddy) need special DKIM?

If your mailboxes are Microsoft 365 plans purchased through GoDaddy, your mail is signed by Microsoft, so you enable DKIM on the Microsoft side rather than inventing your own key. In the Microsoft Defender portal, open Email & collaboration, then Policies & rules, Threat policies and DKIM, select your domain and enable signing. Microsoft then gives you two CNAME records — selector1._domainkey and selector2._domainkey — pointing at onmicrosoft.com targets. Add both as CNAME records in GoDaddy's DNS manager, entering only the host label in the Name field. Microsoft uses two selectors so it can rotate keys without interruption, which is why you publish a pair rather than a single record. Your SPF include for these mailboxes is spf.protection.outlook.com.

How long until the records take effect?

GoDaddy typically publishes DNS changes within an hour, and many updates are visible to resolvers within a few minutes. Full global propagation can take up to 48 hours in uncommon cases, mostly because of caching: resolvers around the world hold a record for the length of its TTL before fetching a fresh copy. You can lower the TTL before making changes to shorten that window, but it is rarely necessary for a one-time setup. To check progress, send yourself a test message and inspect the headers for dkim=pass and an spf=pass result, or run a verification tool against your domain. If a record still does not resolve after a day, the cause is almost always a wrong host field rather than slow propagation.

How to Set Up SPF, DKIM and DMARC on GoDaddy (Step by Step)

Email authentication is one of those tasks that sounds harder than it is. If your domain is registered with GoDaddy and you manage its DNS there, you have everything you need to publish the three records that prove your mail is genuine. Once they are in place, mailbox providers like Gmail, Outlook and Yahoo can verify your messages and reject forgeries sent in your name.

For the site owner (plain English)

This is a setup task, not an emergency. Nothing is broken today — you are adding records that let Gmail, Outlook and the rest confirm your mail is really from you, and reject anyone who forges your name. The whole job happens in one place: log in to GoDaddy, open your domain's DNS, and add three small text entries. Two of them (SPF and DMARC) are single TXT records you can copy from the examples below; the third (DKIM) is a value your email provider hands you to paste in. You do not need a developer or any paid product. If you only do one thing, add the DMARC record at the _dmarc host — that is the one that actually stops impersonation once you ramp it up.

What records will you add, and why?

Three DNS records work together to authenticate your email. You will add all of them inside GoDaddy's DNS manager, and none of them require a paid product or a separate service.

SPF — a single TXT record (defined by RFC 7208) that lists which servers are allowed to send mail using your domain. Receivers check the sending server's IP against this list.
DKIM — a cryptographic signature your mail provider adds to every outgoing message. You publish the matching public key in DNS (usually as a CNAME orTXT record) so receivers can confirm the message was not altered in transit.
DMARC — a TXT record at the _dmarc host that tells receivers what to do when SPF or DKIM fails, and where to send aggregate reports so you can watch for abuse before you start enforcing.

SPF and DKIM each prove a piece of the story; DMARC ties them together and gives you visibility and control. For the full conceptual background, see our pillar guide on email authentication.

How do I add the SPF record in GoDaddy?

Sign in to GoDaddy, open My Products, find your domain and choose DNS (or Manage DNS). This opens the DNS records table where you will add all three records. To add SPF, click Add New Record and choose type TXT.

In the Name (host) field enter @, which represents the root of your domain. In the Value field paste your SPF string. The exact value depends on who sends your mail — copy the include: mechanism from your provider's documentation. A domain that sends through Google Workspace, for example, looks like this:

v=spf1 include:_spf.google.com -all

If you send through more than one service, list every include: in the same record. A domain using Google Workspace plus a marketing platform might read:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

End the record with a qualifier: -all (hard fail) tells receivers to reject anything from a server not listed, while ~all (soft fail) marks it suspicious but still accepts it. Start with ~all if you are unsure you have captured every sender, then tighten to -all once you are confident.

Save the record. GoDaddy auto-prepends your domain to the host, so leaving @ in the Name field correctly publishes the record at the root.

How do I add the DKIM record?

DKIM is a two-step process: you enable signing at your mail provider, then publish the key it gives you in GoDaddy. Start on the provider side. In Google Workspace, open Apps → Google Workspace → Gmail → Authenticate email and generate a DKIM key; in Microsoft 365, enable DKIM under Defender → Email & collaboration → Policies → DKIM.

The provider returns one or more records, each tied to a selector — a short label (like google or selector1) that lets a domain rotate keys and run several in parallel.

Back in GoDaddy, add the record exactly as your provider specifies. Many providers use a CNAME: set the Name to the host portion they give you (for example selector1._domainkey) and the Value to the target hostname they provide. Others hand you a long TXT record containing the public key itself:

Type:  TXT
Name:  google._domainkey
Value: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ...

Enter only the host label in the Name field (google._domainkey, not the full domain) — GoDaddy appends the domain for you. Save the record, then return to your provider and click Start authentication (or the equivalent) so it begins signing outgoing mail with that selector.

How do I add the DMARC record?

DMARC is a single TXT record. In GoDaddy, add a new TXT record with the Name set to _dmarc (just that, not the full domain) and a value like:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

Begin with p=none. This is monitor-only: it changes nothing about how your mail is delivered, but it starts sending you daily aggregate reports (to the rua address) showing every source sending under your domain. Use those reports to confirm that your legitimate senders pass SPF and DKIM with proper alignment.

After a week or two of clean reports, ramp the policy up. Move to p=quarantine so failing mail lands in spam, and finally to p=reject so forgeries are refused outright:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Reaching p=reject is the goal — it is the only policy that actually stops spoofing. Get there gradually so a misconfigured sender never silently loses real mail. For a deeper walkthrough of the ramp using a real mailbox provider, see our Google Workspace DMARC guide.

Common gotcha: GoDaddy's DNS UI expects the host in the Name field, not the full domain. Enter @ for the root and _dmarc for DMARC — GoDaddy appends your domain automatically. Pasting the FQDN double-appends it, producing broken records like _dmarc.example.com.example.com. And remember: a domain may have only one SPF record. If SPF already exists, edit it and merge your new include: into it — never add a second TXT record starting with v=spf1, because two SPF records invalidate each other.

Verify and check propagation

DNS changes are not instant. GoDaddy usually publishes within an hour, though full global propagation can take up to 48 hours in rare cases. Most updates are visible within minutes to a couple of hours.

What to check

SPF: confirm exactly one v=spf1 TXT record exists at the root and it lists every legitimate sender.
DKIM: send a test message to yourself and view the headers — a passing dkim=pass with your domain in the d= tag confirms signing works.
DMARC: verify the _dmarc TXT record resolves and that aggregate reports begin arriving at your rua address within a day or two.

Rather than reading raw DNS by hand, run all three checks at once and see whether your alignment and policy are correct.

Run a free passive check of your domain's SPF, DKIM and DMARC records — no signup, no changes to your DNS.

Check your SPF, DKIM and DMARC →

If something looks wrong, recheck the host fields first — a double-appended domain or a duplicate SPF record is by far the most common cause of a setup that "looks right" but still fails.

Keep going

For the full picture of how these records fit together, read the pillar guide on email authentication, and for a provider-specific ramp see setting up DMARC on Google Workspace or Microsoft 365 / Office 365. If SPF breaks after you edit it, see how to fix multiple SPF records and how to fix SPF too many DNS lookups.

How to Set Up SPF, DKIM and DMARC on GoDaddy