How to Set Up a DMARC Record in GoDaddy

What a DMARC record actually is

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is one line of text you publish in DNS. It tells receiving mail servers two things: what to do with a message that claims to come from your domain but fails authentication, and where to send reports about it. It is not software, not a subscription, and not something you install. It is a single TXT record.

DMARC only works on top of two other records. SPF (Sender Policy Framework) lists which servers are allowed to send as you. DKIM (DomainKeys Identified Mail) puts a cryptographic signature on your outgoing mail. DMARC checks that at least one of those passes and that the passing domain matches the From address your recipient actually sees. That match is called alignment, and it is the part that catches people out.

Publish a strict DMARC policy before SPF and DKIM are working and you will start rejecting your own invoices. Order matters. SPF first, DKIM second, DMARC last.

Where the DNS records live in GoDaddy

GoDaddy has renamed this area more than once, so older guides send you to menus that no longer exist. The current path is short.

If Domain Protection is switched on for the account, GoDaddy will ask you to verify your identity before it commits the change. That prompt is normal and is not a sign anything is wrong.

• Sign in and open your Domain Portfolio.
• Select the individual domain name. That opens its Domain Settings page.
• Select DNS. You are now in the DNS records list, which GoDaddy's help articles call DNS Management.
• Select Add New Record.
• Choose TXT from the Type menu.
• Fill in the Name, Value and TTL fields.
• Select Save. If you queued several records using Add More Records, the button reads Save All Records instead.

The Name field trap that breaks most GoDaddy DMARC records

This is the failure. GoDaddy's Name field takes the hostname only, without your domain, and appends the zone for you automatically. GoDaddy's own documentation describes it as "the hostname or prefix without the domain name," with @ standing in for the root.

So for DMARC you type _dmarc and nothing else. If you paste _dmarc.yourdomain.com, GoDaddy accepts it without complaint and publishes the record at _dmarc.yourdomain.com.yourdomain.com. There is no error, no warning, and no red text. The record list often displays the short name back to you, so it looks correct at a glance. Meanwhile every DMARC checker in the world reports nothing found, and you lose an afternoon blaming propagation.

The same rule applies to every record you will touch here. DKIM hosts go in as selector1._domainkey, never selector1._domainkey.yourdomain.com. SPF goes in as @, not your domain name typed out.

The exact record to enter

Use these values, with your own reporting address substituted in.

Start at p=none. That policy changes nothing about how your mail is delivered. All it does is switch on reporting so you can see who is sending as your domain before you make any decisions. Read the reports for two to four weeks, then move to p=quarantine, and only then consider p=reject. GoDaddy's own help article uses p=quarantine with pct=100 in its example. That is a reasonable destination and a poor starting point if you have never read a report.

One extra note if you send your reports to an address on a different domain, which is common when you use a reporting service. That other domain has to publish a record authorizing it, in the form yourdomain.com._report._dmarc.theirdomain.com with the value v=DMARC1. Without it, most reporters will refuse to send you anything. Your reporting vendor will supply this record.

• Type: TXT
• Name: _dmarc
• Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
• TTL: 1 Hour is the default. Use Custom and 600 seconds while you are still testing.

How DKIM gets enabled, and why GoDaddy is not where it happens

GoDaddy does not generate DKIM keys. It stores the records, nothing more. The key is created wherever your mail is genuinely sent from, and that is the step people get stuck on because they keep looking for it in the GoDaddy panel.

Whichever platform you use, the pattern is the same. The sending platform generates the key, hands you a host and a value, you add it in GoDaddy DNS with the host portion only, then you return to the platform and tell it to verify.

• Microsoft 365 from GoDaddy: keys are generated in the Microsoft Defender portal, not in GoDaddy. Sign in there with your Microsoft 365 email address and password. Your GoDaddy username and password will not work. Under DomainKeys Identified Mail (DKIM), select your domain, then Create DKIM keys. Microsoft produces two CNAME records, selector1._domainkey and selector2._domainkey. Add both at GoDaddy. Then go back to Defender, open More options beside the domain and choose Verify Key to switch DKIM on.
• Professional Email from GoDaddy (powered by Titan): the values sit in your Email & Office Dashboard under the DKIM CNAME records step. The two hosts are secureserver1._domainkey and secureserver2._domainkey, added as CNAME with a 1 Hour TTL. If your domain, DNS and email are all in the same GoDaddy account, GoDaddy has already added your SPF record (v=spf1 include:secureserver.net -all). Do not add a second one.
• Google Workspace: generate the key in Google Admin under Apps, Google Workspace, Gmail, Authenticate email. Pick the 2048-bit option. Google gives you a TXT record at google._domainkey.
• Everything else: a CRM, an invoicing tool, a shop platform, a newsletter service. Each generates its own key and hands you its own record. GoDaddy's only job is storing what they give you.

GoDaddy quirks that cause silent failures

These are the specific behaviors of this panel. Most of them produce no error message, which is exactly why they waste time.

• The Value field accepts a maximum of 1024 characters and ASCII characters only. That is generous for DMARC and tight for some DKIM keys.
• The 255-character rule is DNS itself, not GoDaddy. A single TXT string cannot exceed 255 characters, and a 2048-bit DKIM key runs to roughly 400. If your provider hands you a value already broken into quoted chunks, paste the entire thing, quotes included, into one Value field. Creating two separate records instead is the classic mistake and produces a key that never validates.
• The Name field allows periods, but not as the first or last character. Labels are capped at 63 characters between periods and 255 overall.
• TTL defaults to 1 Hour. That means a wrong record can sit in resolver caches for an hour after you correct it. Drop it to a Custom 600 seconds while testing, then raise it once everything passes. When you edit an existing record, the old TTL governs how long the stale answer survives, not the new one.
• GoDaddy quotes propagation as usually within an hour and up to 48 hours globally. A brand new _dmarc record with no cached negative answer normally resolves within minutes.
• Only ever publish one SPF record. Two SPF TXT records on the same domain is a permanent error that takes SPF down completely, and DMARC alignment with it.
• If your nameservers point somewhere other than GoDaddy, Cloudflare or your web host for instance, the GoDaddy DNS panel is not authoritative. You can type records into it all day and nothing will publish. Check the Nameservers section on the Domain Settings page before you touch anything else.

Letting someone help without handing over your password

GoDaddy has a proper answer for this and it is called Delegate Access. Nobody should be emailing GoDaddy credentials to a consultant, and with this feature nobody needs to.

The invitation is emailed and it does expire. GoDaddy's documentation puts the window at roughly 48 to 72 hours. If your helper does not accept in time, just send it again. They need their own GoDaddy account to accept, and once they do they switch into yours from their own account menu.

A delegate cannot view or change your password or your payment methods. GoDaddy blocks that at the platform level, so it is not a matter of trust. You can revoke access from the same page at any moment, and you should as soon as the work is finished. You can also narrow the scope using Folders, toggling Management Access and Transfer Access per folder rather than across every domain you own.

One honest caveat worth knowing. GoDaddy's published permission list for Management Access spells out nameservers, forwarding, contacts and subdomains, and does not explicitly name DNS record editing. In practice a Products & Domains delegate can open DNS Management and add records. Have your helper confirm they can actually see the Add New Record button before either of you assumes it worked.

• Go to Account Settings, then Delegate Access.
• Under the heading "People who can access my account", select Invite to Access.
• Enter the person's name and email address.
• Choose an access level. For DNS work, Products & Domains is the one you want. Domains Only covers registrar-level actions such as contacts and transfers. Products, Domains & Purchase also lets them spend money using your stored payment method, which is not needed for a DNS change.
• Select Invite.

How to check it actually worked

A saved row in the GoDaddy panel is not proof of anything. Query public DNS directly.

On Windows, run nslookup -type=TXT _dmarc.yourdomain.com 8.8.8.8. On Mac or Linux, run dig TXT _dmarc.yourdomain.com +short @1.1.1.1. Query an outside resolver on purpose (8.8.8.8 is Google, 1.1.1.1 is Cloudflare) because your own office network may still be holding the old answer. You want exactly one string back, beginning with v=DMARC1.

If nothing comes back, run the doubled-name check straight away: dig TXT _dmarc.yourdomain.com.yourdomain.com +short. If your record turns up there, you pasted the full hostname into the Name field. Edit the record, cut it back to _dmarc, and save.

Then test end to end. Send a message from your real mail platform to a Gmail address. Open it, use the three-dot menu and choose Show original. You are looking for SPF: PASS, DKIM: PASS and DMARC: PASS, and critically for the DKIM signing domain to match the domain in your From address. A DKIM pass on the wrong domain still fails DMARC, and this screen is where you catch it.

After that, wait. Aggregate reports arrive daily at your rua address as gzipped XML attachments. They are the only honest view of who else is sending mail as your domain.

What GoDaddy cannot do for you

GoDaddy is a competent place to store DNS records. It is not an email authentication tool, and it does not pretend to be. Knowing the gaps saves you from waiting for help that is never coming.

• It will not read your DMARC reports. Those XML attachments are effectively unreadable by eye, and GoDaddy provides no parser. You need a reporting service or a person to interpret them.
• It will not generate DKIM keys. Every key comes from the platform that sends your mail.
• It will not validate your syntax. GoDaddy checks that the value is ASCII and short enough. It does not check whether your DMARC tags make sense, whether your SPF has quietly exceeded the 10-lookup limit, or whether you have just instructed the world to reject your own order confirmations.
• There is no change history in the DNS panel. If a record vanishes, you cannot see who removed it or when.
• There is no staged rollout. Moving from none to quarantine to reject is a manual edit each time, on your calendar, not GoDaddy's.
• Permissions stop at the folder level. You cannot grant someone access to a single record.

Do it yourself, or bring us in

If your mail sends from one platform and your nameservers are at GoDaddy, this is genuinely a ten minute job and the instructions above are complete. Do it yourself and keep your money. That is a real recommendation, not modesty.

Bring in help when the picture is messier. Several sending tools, a domain that used to send from a service nobody remembers signing up for, an SPF record that has drifted past the lookup limit, or a p=reject deadline handed down by a customer, a payment processor or a marketplace.

We are JWC Apps, based in San Diego, and we run this as a done-for-you service. We work through GoDaddy Delegate Access, so we never ask for your password, and we never accept government IDs or card numbers at any stage. We publish the records, read the reports, and move your policy up in steps only when the data says it is safe to. We cannot promise how any given mailbox provider will treat your mail, and anyone who does is guessing. What we can do is make sure the records are correct, aligned, and verified against real DNS rather than a green tick in a control panel.