How to Add SPF and DKIM Records in GoDaddy (2026 Step-by-Step Guide, Plus DMARC)

To add SPF and DKIM records in GoDaddy, sign in to your GoDaddy Domain Portfolio, select the domain, select DNS, then choose Add New Record. Per GoDaddy's SPF help article, SPF is a TXT record with the Name set to @ and the Value set to the SPF line from your email provider, for example v=spf1 include:_spf.google.com ~all for Google Workspace. DKIM is a second record whose name and value come from your email provider: a TXT record named google._domainkey for Google Workspace, or two CNAME records for Microsoft 365 and for GoDaddy's Professional Email. Save, then allow up to 48 hours for the change to reach every mail server.

Last updated: November 2026. This guide is for small business owners who bought their domain at GoDaddy and send business email from it. Every step, record value and limit below was checked against GoDaddy, Google, Microsoft and the SPF standard on November 11, 2026; the sources are linked inline and listed at the end.

• Where: GoDaddy Domain Portfolio, select the domain, DNS, Add New Record. Your domain must be using GoDaddy nameservers for records added there to work.
• SPF: one TXT record, Name @, Value starting with v=spf1. Only one SPF record works on a domain at a time, so edit the existing one instead of adding a second.
• DKIM: the record type depends on the email provider. Google Workspace gives you one TXT record; Microsoft 365 and GoDaddy Professional Email powered by Titan give you two CNAME records.
• Name field: GoDaddy wants the prefix only, without your domain. Enter google._domainkey, not google._domainkey.yourbusiness.com.
• Timing: GoDaddy says most DNS updates take effect within an hour but can take up to 48 hours globally.
• Why it matters: Google requires every sender to personal Gmail accounts to have SPF or DKIM, and senders of more than 5,000 messages a day to have SPF, DKIM and DMARC.

All three are DNS records that let receiving mail servers check that a message claiming to come from your domain really did. GoDaddy summarizes them this way: SPF specifies which servers can send email from your domain, DKIM adds a digital signature to prove a message came from your domain, and DMARC specifies how to handle and report messages that fail those checks.

This is no longer optional housekeeping. Google's Email sender guidelines state that, starting in 2024, senders must meet its requirements to deliver to personal Gmail accounts (addresses ending in @gmail.com or @googlemail.com). All senders must set up SPF or DKIM. Senders of more than 5,000 messages per day to Gmail accounts must set up SPF, DKIM and DMARC. Google also tells senders to keep the spam rate reported in Postmaster Tools below 0.3%, and warns that mail that does not meet the requirements might not be delivered as expected or might be marked as spam.

For a small business, that means quotes, invoices, appointment confirmations and contact form notifications sent from your own domain are judged by these records. Setting up both SPF and DKIM, not just one, is the safer choice, and it is what both Google and Microsoft recommend.

• Confirm the nameservers: GoDaddy states your domain must be using GoDaddy nameservers to add an SPF record in your GoDaddy account. If your DNS is managed elsewhere (for example at Cloudflare or your web host), add the records there instead.
• List every service that sends email as your domain: Google's SPF guide names the usual suspects, including web servers, "Contact us" forms, on-premise mail servers and any third-party service that sends email for your domain, such as a newsletter or invoicing tool.
• Get the exact values from each provider: the SPF include and the DKIM record name and value are issued by the email provider, not by GoDaddy. Copy and paste them; do not retype them.
• Check for an existing SPF record: look in the DNS list for a TXT record whose value starts with v=spf1. If one exists, you will edit it rather than add another.

These are the steps from GoDaddy's "Add an SPF record" article:

• Step 1: Sign in to your GoDaddy Domain Portfolio and select the domain to open its Domain Settings page.
• Step 2: Select DNS to view your DNS records.
• Step 3: Select Add New Record, then select TXT from the Type menu.
• Step 4: In Name, enter @ to put the record on your root domain.
• Step 5: In Value, paste the SPF line for your email provider (see the list below). GoDaddy allows a maximum of 512 ASCII characters for an SPF value.
• Step 6: Leave TTL at the default, which is 1 hour.
• Step 7: Select Save. If your domain has Domain Protection, GoDaddy asks for extra identity verification, such as a 2-step verification code, before it saves.

The SPF value depends on who sends your mail. These are the values published by the providers themselves:

• Google Workspace only: v=spf1 include:_spf.google.com ~all
• Microsoft 365 bought directly from Microsoft: v=spf1 include:spf.protection.outlook.com -all
• GoDaddy Professional Email, Microsoft 365 from GoDaddy or GoDaddy Linux Hosting: v=spf1 include:secureserver.net -all
• Google Workspace plus GoDaddy mail servers: v=spf1 include:_spf.google.com include:secureserver.net ~all
• Google Workspace plus Mailchimp: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

The Google Workspace combinations come from Google's "Set up SPF" page, which also notes that Google recommends ~all. The Microsoft value comes from Microsoft's SPF documentation, which recommends -all (hard fail) for Microsoft 365 domains. Note the GoDaddy detail: if you bought Microsoft 365 through GoDaddy, GoDaddy says the SPF value must be the secureserver.net one, not the outlook.com one.

Two rules cause most SPF failures. First, one record only: GoDaddy says only one SPF record will work on your domain at a time, and the SPF standard, RFC 7208, says a domain must not have multiple SPF records and that a check finding more than one returns a "permerror" result. If you use two services, merge them into a single line with two include: entries, as in the examples above. Second, keep it short: RFC 7208 limits the terms that trigger DNS queries (include, a, mx, ptr, exists and redirect) to 10 per SPF evaluation, and going over also returns "permerror". Remove includes for services you no longer use.

Unlike SPF, there is no generic DKIM value. Your email provider generates the key, and you publish it in GoDaddy DNS under a name ending in ._domainkey. The record type differs by provider.

Google Workspace (one TXT record). Following Google's "Set up DKIM" page:

• Step 1: In the Google Admin console, go to Apps, Google Workspace, Gmail, then click Authenticate email. You need to be signed in as a super administrator.
• Step 2: Select your domain and click Generate New Record. Choose the 2048-bit key if your domain provider supports it (Google notes longer keys are more secure) and keep the default prefix selector, google.
• Step 3: Copy the DNS Host name (google._domainkey) and the TXT record value, which is formatted like v=DKIM1; k=rsa; p= followed by the key. Do not click Start authentication yet.
• Step 4: In GoDaddy, select DNS, Add New Record, Type TXT. Enter google._domainkey as the Name and paste the value. Save.
• Step 5: Back in the Admin console, click Start authentication. When it is working, the status changes to "Authenticating email with DKIM".

Two Google timing notes: after you first turn on Gmail for your organization you must wait 24 to 72 hours before you can generate a DKIM key, and after adding the key it can take up to 48 hours for DKIM authentication to start working. On size, GoDaddy's TXT record article gives a maximum of 1,024 characters for a TXT value. If GoDaddy rejects the value, check for stray spaces or quotation marks copied with it before falling back to a 1024-bit key, which Google lists as the minimum length for sending to personal Gmail accounts.

Microsoft 365 (two CNAME records). Microsoft's DKIM documentation explains that Microsoft 365 stores its public keys behind CNAME records rather than TXT records, and that the hostnames are the same for every organization: selector1._domainkey and selector2._domainkey. The "points to" values are unique to your tenant. Find them in the Microsoft Defender portal under Email & collaboration, Policies & rules, Threat policies, Email authentication settings, on the DKIM tab. Add both as CNAME records in GoDaddy, wait for Microsoft 365 to detect them (Microsoft says a few minutes or possibly longer), then switch on the "Sign messages for this domain with DKIM signatures" toggle.

GoDaddy Professional Email powered by Titan (two CNAME records). GoDaddy's instructions say to open the Email & Office Dashboard, select Manage next to your user and copy the two DKIM CNAME records shown there. In DNS, add them with the names secureserver1._domainkey and secureserver2._domainkey and the values you copied. With the SPF and DMARC records, that makes four records in total. GoDaddy adds that if your domain, DNS and email are in the same GoDaddy account, the SPF record has already been added for you.

For any CNAME, GoDaddy's CNAME article applies the same rule as for TXT: the Name is the prefix without the domain name, it cannot be @, and it must not already be in use by another record.

Yes, once SPF and DKIM are passing. DMARC is one more TXT record. Google's "Set up DMARC" page says SPF and DKIM should be authenticating messages for at least 48 hours before you turn DMARC on, and GoDaddy likewise says to add SPF and DKIM before DMARC. In GoDaddy the record looks like this:

• Type: TXT
• Name: _dmarc
• Value (starting point): v=DMARC1; p=none; rua=mailto:[email protected]
• TTL: 1 hour

Replace the address with a mailbox on your own domain. In that value, v must be DMARC1, p is the policy, and rua is where receiving servers send daily reports. Google recommends starting with p=none, which delivers mail normally while you read the reports, then moving to quarantine (send failing mail to spam) or reject over time once you are sure every legitimate sender passes. Google also suggests a dedicated mailbox or group for the reports, because they can arrive daily.

Be careful not to jump straight to p=reject. If a newsletter tool or website form you forgot about is not covered by SPF or DKIM, a strict policy tells receiving servers to refuse that mail.

GoDaddy says most DNS updates take effect within an hour but could take up to 48 hours to update globally. Its article on DNS propagation explains why: the TTL on each record, caching by internet service providers and the domain's registry all affect timing. If nothing has changed after 48 hours, GoDaddy suggests the cause is more likely an incorrect DNS setting than slow propagation.

The most reliable test is a real message. Google's DKIM guide describes it:

• Step 1: Send an email from your business address to someone using Gmail or Google Workspace. Google notes you cannot verify DKIM by sending yourself a test message.
• Step 2: In Gmail, open the message, click More next to Reply, and choose Show original.
• Step 3: Find the Authentication-Results header. Google says the DKIM result should read something like DKIM=pass or DKIM=OK.

Repeat the test for each tool that sends as your domain: your mailbox, your website contact form and your newsletter platform. One passing sender does not prove the others pass.

• Two SPF records: adding a new v=spf1 record next to an old one. Only one works, so combine the includes into a single record.
• Domain typed into the Name field: GoDaddy asks for the prefix without the domain name. Enter only @, google._domainkey, selector1._domainkey or _dmarc.
• Wrong record type for DKIM: Google Workspace DKIM is a TXT record; Microsoft 365 and Professional Email powered by Titan use CNAME records.
• Only one of two CNAMEs added: Microsoft 365 and Titan each need both DKIM records.
• Wrong SPF for Microsoft 365 from GoDaddy: GoDaddy specifies v=spf1 include:secureserver.net -all for that product.
• Never switching DKIM on: publishing the DNS record is half the job. Google Workspace needs Start authentication and Microsoft 365 needs its signing toggle.
• Forgotten senders: a contact form, booking tool or email marketing platform that sends as your domain but is missing from SPF and has no DKIM.
• Editing DNS in the wrong place: records added in GoDaddy do nothing if the domain's nameservers point somewhere else.

Authentication is one part of a healthy sending setup. If email is a sales channel for you, the same care applies to the pages those emails lead to and to how you measure results; see our guides to landing page optimization for lead generation and GA4 and Google Ads conversion tracking, or our email marketing services.

All sources were opened and checked on November 11, 2026.

GoDaddy Help: Add an SPF record | GoDaddy Help: Add a TXT record | GoDaddy Help: Add a CNAME record | GoDaddy Help: Add SPF, DKIM and DMARC to my domain for Professional Email powered by Titan | GoDaddy Help: What factors affect DNS propagation time? | Google Workspace Help: Set up SPF | Google Workspace Help: Set up DKIM | Google Workspace Help: Set up DMARC | Google Workspace Help: Email sender guidelines | Microsoft Learn: Set up SPF to identify valid email sources for your Microsoft 365 domain | Microsoft Learn: How to use DKIM for email in your custom domain | RFC 7208: Sender Policy Framework (SPF), sections 3.2, 4.5 and 4.6.4