SPF, DKIM & DMARC for GoDaddy.
GoDaddy Professional Email — now sold as "Professional Email, powered by Titan" — authenticates your domain with three ordinary DNS records rather than a wizard: an SPF TXT record carrying GoDaddy's shared include:secureserver.net, two DKIM CNAMEs (secureserver1._domainkey and secureserver2._domainkey) delegated back to GoDaddy, and a DMARC policy at _dmarc. There's a twist unique to GoDaddy: since April 2025 it automatically injects DKIM and a default DMARC record on domains bought or transferred into GoDaddy, so part of the setup may already be done before you touch anything. If GoDaddy hosts both your DNS and your mailboxes it can apply the records for you; if your DNS lives elsewhere you copy the values out of the Email & Office Dashboard and add them by hand.
Why authenticate GoDaddy?
Authenticating GoDaddy-hosted mail is what decides whether it reaches the inbox. Since February 2024 Gmail and Yahoo have required every sender to pass SPF or DKIM, and every bulk sender (roughly 5,000+ messages a day) to also publish a DMARC policy with alignment; Microsoft began enforcing the same on high-volume mail to Outlook.com and Hotmail in May 2025. Until SPF and DKIM both align to your domain, GoDaddy mail is only weakly attributable to you, DMARC can't pass, and forwarded messages fall apart. GoDaddy adds a second, self-inflicted reason to get this right: on new and transferred domains it now publishes a default DMARC record at p=quarantine — so the day you point a CRM, a contact-form plugin, or a newsletter tool at your domain without authenticating it, that mail is actively routed to spam by your own policy. Doing SPF, DKIM, and DMARC properly aligns your real senders, keeps the quarantine policy working for you instead of against you, and builds sending reputation under your own domain.
The SPF reality for GoDaddy
GoDaddy Professional Email is a genuine "include" provider: you add one shared mechanism, include:secureserver.net, to the single SPF TXT record on your root domain — GoDaddy publishes it as v=spf1 include:secureserver.net -all. Because your GoDaddy mailbox sends with an envelope (Return-Path) on your own domain, SPF actually aligns and contributes a DMARC pass, not just DKIM. Two realities make GoDaddy's SPF unusual. First, it is expensive: secureserver.net does NOT flatten to IP ranges directly — it nests, secureserver.net → include:spf-0.secureserver.net → include:spf.protection.outlook.com — so it consumes THREE of your 10 allowed SPF DNS lookups, where Google Workspace and Microsoft 365 each cost only one. Add any other sender on top and you can march toward the RFC 7208 10-lookup PermError limit fast. Second, include:secureserver.net authorizes GoDaddy-hosted mail (Professional Email / Titan and GoDaddy Linux/cPanel hosting) and nothing else. A large share of "GoDaddy" domains actually send through Microsoft 365 (even when the subscription was bought through GoDaddy) or Google Workspace — those need include:spf.protection.outlook.com or include:_spf.google.com instead, and leaving secureserver.net in place both wastes three lookups and authorizes servers you never send from. One more: GoDaddy's own email-marketing product (GoDaddy Digital Marketing / campaigns) uses a different, flat include, include:spf.em.secureserver.net — it is not the same as mailbox mail. Whatever your mix, keep exactly one SPF record and merge every mechanism into that single v=spf1 line.
Step by step
- 1
Confirm GoDaddy actually sends your mail
include:secureserver.net only belongs on your domain if your mailboxes are GoDaddy Professional Email / Titan, or you send from GoDaddy Linux/cPanel hosting. If you moved to Microsoft 365 or Google Workspace (even bought through GoDaddy), skip secureserver.net entirely and use include:spf.protection.outlook.com or include:_spf.google.com instead. Using the wrong include here is the single most common GoDaddy authentication mistake.
- 2
Check what GoDaddy already published
On domains bought or transferred into GoDaddy after April 2025, GoDaddy auto-adds the two DKIM CNAMEs and a default DMARC record (p=quarantine). Open Manage DNS and look for existing secureserver1._domainkey / secureserver2._domainkey CNAMEs and a _dmarc TXT before you add anything — so you edit those records rather than create conflicting duplicates.
- 3
Get your exact record values
Sign in to the Email & Office Dashboard (email.godaddy.com) with your GoDaddy username and password. If GoDaddy hosts your DNS, it can apply the SPF and DKIM records automatically. If your DNS is hosted elsewhere, the dashboard (and GoDaddy's Professional Email help article) gives you the SPF value and the two secureserver._domainkey CNAME targets — which are unique to your account — to copy and add manually.
- 4
Open the DNS editor
For GoDaddy-hosted DNS, sign in and open your Domain Portfolio (older accounts call it My Products), select the sending domain, and open Domain → DNS (Manage DNS). You'll see a table of existing records; use Add New Record to create each one. Note GoDaddy's Name convention: it appends your domain automatically, so you enter the part in front of it (@ for the root), never the full hostname.
- 5
Add or merge the SPF record
Type TXT, Name @ (GoDaddy's shorthand for the root domain), Value v=spf1 include:secureserver.net -all. If an SPF record already exists, do NOT add a second one — edit the existing record and merge include:secureserver.net into that single v=spf1 line. Two SPF records is a PermError and makes SPF silently fail.
- 6
Add the two DKIM CNAMEs
Type CNAME for both. First record: Name secureserver1._domainkey, Value = the first target from your dashboard. Second record: Name secureserver2._domainkey, Value = its target. Set TTL to 1 Hour. If GoDaddy pre-created these on a post-April-2025 domain, just confirm the values match rather than duplicating them. Because they're CNAMEs delegated to GoDaddy, GoDaddy holds the private keys and can rotate them without you re-editing DNS.
- 7
Set (or reclaim) the DMARC record
Type TXT, Name _dmarc, Value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com to start in monitor mode. Critical GoDaddy twist: the default DMARC GoDaddy injects sends its aggregate reports to rua=mailto:dmarc_rua@onsecureserver.net — meaning the reports go to GoDaddy, not you. Edit the record so rua points at your own mailbox or a DMARC analyzer. Keep p=quarantine only if every sender is already authenticated; drop to p=none while you're still bringing senders into alignment so you don't quarantine legitimate mail.
- 8
Wait for propagation, then test on a real message
GoDaddy DNS changes usually take effect within an hour but can take up to 48 hours. Send a message from your GoDaddy mailbox to a Gmail account, open it, and choose ⋮ → Show original. You want SPF: PASS, DKIM: PASS signed by yourdomain.com (selector secureserver1 or secureserver2), and DMARC: PASS — all aligned to your domain, not to secureserver.net.
- 9
Confirm the records and watch the lookup budget
Run the domain through Qualisend's domain health check and the SPF/DKIM/DMARC checker to confirm every record resolves. Pay attention to the SPF lookup count: secureserver.net alone eats three of your ten lookups, so if you also send through other tools you can hit the limit — flatten or drop unused includes. Once DMARC reports arrive at your own rua address, feed them into the report analyzer to confirm GoDaddy shows up as an aligned, passing source.
Records to add
GoDaddy generates the exact values in its setup wizard — these show the shape of what you'll add at your DNS host.
| Type | Host | Value |
|---|---|---|
| TXT | @ | v=spf1 include:secureserver.net -allRoot SPF for GoDaddy Professional Email / Titan. Keep exactly one SPF record — merge other senders into this line. This include costs 3 DNS lookups (it nests secureserver.net → spf-0.secureserver.net → spf.protection.outlook.com). |
| CNAME | secureserver1._domainkey | <unique-target-1>.dkim.secureserver.netIllustrative — GoDaddy generates the exact CNAME target per account. Copy the real value from your Email & Office Dashboard. TTL 1 Hour. |
| CNAME | secureserver2._domainkey | <unique-target-2>.dkim.secureserver.netIllustrative — second DKIM selector, also per-account. Copy the exact target from your dashboard. TTL 1 Hour. |
| TXT | _dmarc | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comOne DMARC record per domain. GoDaddy may have pre-added one at p=quarantine with rua=mailto:dmarc_rua@onsecureserver.net (reports go to GoDaddy) — edit it to point rua at your own address. |
Keep exactly one SPF (v=spf1) TXT record on your root domain — merge every sender into it. Two SPF records is itself an error.
The 10-lookup budget
SPF is capped at a hard 10 DNS lookups — go over and it returns a permerror and stops validating everywhere. Here's what GoDaddy's setup costs against that budget.
GoDaddy adds 3 of your 10 lookups; ip4: and ip6: mechanisms are free.
DKIM
DKIM for GoDaddy Professional Email is delegated, not pasted. You publish two CNAME records — secureserver1._domainkey and secureserver2._domainkey — each pointing to a per-account target that ends in secureserver.net, and GoDaddy holds the matching private keys and signs your outbound mail with them. Because they're CNAMEs delegated back to GoDaddy rather than TXT records you own, GoDaddy can rotate the published keys behind those two selectors without you ever editing DNS again. Both the classic Professional Email and the newer Professional Email powered by Titan use the same secureserver1 / secureserver2 selectors. On domains bought or transferred into GoDaddy after April 2025, GoDaddy adds these two CNAMEs automatically for Professional Email — so before you create them, open Manage DNS and check whether they already exist (confirm the values, don't duplicate). If GoDaddy hosts your DNS and your mailboxes, the whole thing is often applied for you; only when your DNS is hosted elsewhere do you copy the two exact targets from the Email & Office Dashboard and add them by hand. Don't type the full hostname in the Name field — GoDaddy appends your domain, so you enter secureserver1._domainkey, not secureserver1._domainkey.yourdomain.com.
DMARC
DMARC is a separate policy record at _dmarc.yourdomain.com, and GoDaddy is one of the few registrars that publishes one for you. Since April 2025 every domain bought or transferred into GoDaddy gets a default DMARC record injected into the zone at p=quarantine — so failing mail is already being sent to spam — with the aggregate reports (rua) pointed at GoDaddy's own address, dmarc_rua@onsecureserver.net, not yours. (GoDaddy started the rollout at p=reject and softened it to p=quarantine partway through, so an older domain may still carry the harder policy — check yours.) Two things follow. First, reclaim your reporting: edit the record so rua points at your own mailbox or a DMARC analyzer, or you'll never see who is sending as your domain. Second, choose the policy deliberately. If every legitimate sender is authenticated and aligned, keeping p=quarantine (and later tightening to p=reject) is exactly right. But if you're still bringing senders into alignment, temporarily set p=none so the default quarantine doesn't silently spam-file your real mail while you finish. Keep exactly one _dmarc record for the whole domain no matter how many senders you use, and remember you retain full control — GoDaddy's injected record is a normal, editable TXT record, not something locked.
Check it actually worked
Don't trust GoDaddy's dashboard or the injected records alone — confirm it on a real message. Send from your GoDaddy mailbox to a Gmail account, open the message, and choose ⋮ → Show original: you want SPF: PASS, DKIM: PASS with signed-by: yourdomain.com (selector secureserver1 or secureserver2), and DMARC: PASS, all aligned to your domain rather than secureserver.net. Prefer a full report? Send a test to check-auth@verifier.port25.com and it emails back a breakdown. You can spot-check the raw records with dig TXT yourdomain.com, dig CNAME secureserver1._domainkey.yourdomain.com, and dig TXT _dmarc.yourdomain.com. GoDaddy propagation is usually under an hour but can take up to 48. Finally, run the domain through Qualisend's domain health check to confirm every record resolves and — importantly for GoDaddy — that secureserver.net's three-lookup chain hasn't pushed your SPF over the 10-lookup limit; once reports reach your own rua address, drop one into the DMARC report analyzer to confirm GoDaddy is an aligned, passing source.
Common gotchas
- Breaks auth
include:secureserver.net costs 3 SPF lookups, not 1 — it nests secureserver.net → spf-0.secureserver.net → spf.protection.outlook.com. Combined with any other sender (Google, Mailchimp, an ESP) this chain alone can push you toward the 10-lookup PermError limit, where SPF silently stops working.
- Coverage
secureserver.net is the WRONG include if you actually send through Microsoft 365 (even a subscription bought via GoDaddy) or Google Workspace. Use include:spf.protection.outlook.com or include:_spf.google.com instead — keeping secureserver.net authorizes servers you don't send from and won't align your real mail.
- Coverage
Since April 2025 GoDaddy silently injects a default DMARC record on new and transferred domains at p=quarantine, with rua pointing to dmarc_rua@onsecureserver.net — so failing mail is already being quarantined and the reports go to GoDaddy, not you. Edit the record to add your own rua.
- Coverage
The p=quarantine default can quietly route legitimate-but-unauthenticated mail (a CRM, a form plugin, a newsletter tool you forgot about) straight to spam. Inventory every sender and get each one aligned before trusting the default policy.
- Breaks auth
Only one SPF record is allowed per domain. A second v=spf1 TXT record is a PermError that makes SPF fail entirely — always merge into the existing record, never add a parallel one.
- Coverage
Mind GoDaddy's Name/@ convention: it appends your domain automatically. Enter @ for the root SPF, secureserver1._domainkey (not the full FQDN) for DKIM, and _dmarc for DMARC. Typing the full domain double-appends it (e.g. _dmarc.yourdomain.com.yourdomain.com).
- Breaks auth
If your nameservers point away from GoDaddy (Cloudflare, Route 53, your web host), editing DNS inside GoDaddy does nothing — add the records wherever your nameservers actually resolve. Check the domain's nameservers first.
- Coverage
GoDaddy's default SPF ends in -all (hard fail), which is only safe if secureserver.net is your ONLY sender. Add every other sending service to the record first, or use ~all while you consolidate, so you don't hard-fail legitimate mail.
Build your SPF record
GoDaddy is pre-selected below. Add any other platforms you send through, then publish the single merged record.
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listGoDaddy SPF — FAQ
Related reading
Once it's published, confirm everything resolves with the domain health check, then read who's sending as you with the DMARC report analyzer. Browse all sending sources in the generator. Authentication is only half of deliverability, though — a listed sending IP or domain still lands you in spam no matter how clean your SPF is, so it's worth watching the blacklists with blacklist monitoring.
Authenticated — now keep the list clean
Passing SPF, DKIM, and DMARC gets you to the inbox; a clean list keeps you there. Verify yours — start free with 100 credits, no card required.