How to set up SPF, DKIM and DMARC on GoDaddy, step by step
If your emails land in spam or someone sends fake messages using your domain, you're almost certainly missing three records: SPF, DKIM and DMARC. Since 2024 Gmail and Yahoo require them from bulk senders, and they help every business. This guide walks you through all three in GoDaddy.
1. Check what you have today
Before changing anything, run your domain through our email checker. It shows which records exist, which are missing and whether any are malformed. Note which service hosts your mail (Microsoft 365, Google Workspace, Zoho…), since each has its own SPF value.
2. Create or fix your SPF record
In GoDaddy, open My Products, click DNS next to your domain and look for a TXT record starting with v=spf1. There can be only one: if you find two, merge them.
If there's none, click Add New Record, choose TXT, enter @ as the Name and your provider's SPF as the Value. Common examples:
- GoDaddy email (Microsoft 365): v=spf1 include:secureserver.net -all
- Google Workspace: v=spf1 include:_spf.google.com ~all
- If you also send through another service (a newsletter tool, say), add its include before -all or ~all.
3. Turn on DKIM with your email provider
Your provider generates DKIM for you. In Google Workspace it's under Apps, Gmail, Authenticate email; in Microsoft 365, in the Defender portal. You'll get one or two records (TXT or CNAME) to paste into GoDaddy DNS exactly as shown, then switch signing on in the provider's panel.
4. Create your DMARC record
Add another TXT record named _dmarc with this value to start in monitoring mode: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. With p=none nothing gets blocked; you just receive reports on who sends mail as your domain.
Once you've confirmed for a few weeks that your legitimate mail passes SPF and DKIM, move to p=quarantine and later p=reject. That last step is what actually stops spoofing.
5. Confirm everything works
DNS changes can take minutes to a few hours. Run your domain through the email checker again, and use the DNS propagation tool to watch the change spread worldwide. Finally, send a test email to a Gmail account and open Show original: SPF, DKIM and DMARC should all read PASS.