How to Add SPF and DMARC Records in GoDaddy DNS

This guide shows how to add SPF and DMARC records in GoDaddy DNS, step by step, for the least technical setup possible. Both are plain-text (TXT) records you create in GoDaddy's DNS manager. SPF lists which servers may send mail for your domain; DMARC tells receiving servers what to do with a message that fails that check.

Two mistakes break email at GoDaddy more than any others: putting a record on the wrong host, and ending up with two SPF records. This walkthrough covers the @ host convention, GoDaddy's own mail include, and the _dmarc host, so your records validate the first time.

The short answer#

Sign in to GoDaddy, open your domain's DNS page, and add two TXT records. One is your SPF record, published on the root domain (host @). The other is your DMARC record, published on the _dmarc host. The table below is the whole job at a glance.

Swap secureserver.net for your own mail provider's include value — the platform table further down lists the common ones.

What SPF and DMARC actually do#

SPF and DMARC are two of the three records that prove your mail is really yours; DKIM is the third. Together they cut down on spoofing and phishing, and Gmail and Yahoo now require them for anyone sending in bulk.

• SPF (Sender Policy Framework) publishes the list of servers allowed to send mail for your domain. It is defined in RFC 7208, and a domain may publish only one SPF record.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers whether to accept, quarantine, or reject mail that fails SPF or DKIM, and where to send reports. It is defined in RFC 9989.
• DKIM adds a cryptographic signature. GoDaddy usually sets DKIM up with your email product, so this guide focuses on the two TXT records you add by hand.

Before you start#

• The include value for your email provider. GoDaddy Professional Email uses include:secureserver.net; Microsoft 365 uses include:spf.protection.outlook.com — even if you bought the subscription through GoDaddy.
• Access to the GoDaddy account that owns the domain. If Domain Protection is on, GoDaddy asks for a verification code — by SMS, authenticator app, or a one-time password — before it saves any DNS change.
• A mailbox you can read for DMARC reports, such as [email protected].
• A quick look at your current DNS. If GoDaddy set up your email, an SPF record may already exist — you will edit that one, not add a second.

How to add an SPF record in GoDaddy#

1. 1

   Sign in and open your domain

   Go to your GoDaddy Domain Portfolio, then select the domain you want to authenticate to open its Domain Settings page.

2. 2

   Open DNS

   Select DNS to see the full list of DNS records for that domain.

3. 3

   Check for an existing SPF record first

   Look for any TXT record whose value starts with v=spf1. If one already exists, edit it instead of adding a new one — a domain may hold only one SPF record.

4. 4

   Add a new TXT record

   Select Add New Record, then choose TXT from the Type menu.

5. 5

   Set the host and value

   In the Name field, enter @ to publish on your root domain. In the Value field, enter your SPF record — for example v=spf1 include:secureserver.net -all for GoDaddy Professional Email.

6. 6

   Save

   Select Save (or Save All Records if you added several at once). GoDaddy says most changes apply within an hour and up to 48 hours worldwide.

How to add a DMARC record in GoDaddy#

1. 1

   Add another TXT record

   Back on the DNS page, select Add New Record and choose TXT again.

2. 2

   Set the host to _dmarc

   In the Name field, enter _dmarc — not @. DMARC always lives on the _dmarc host of your domain.

3. 3

   Enter a starter DMARC value

   In the Value field, enter v=DMARC1; p=none; rua=mailto:[email protected], using a real address you can read for the reports.

4. 4

   Save and wait

   Select Save. Give DNS up to 48 hours to update everywhere before you rely on the record.

5. 5

   Move from monitoring to enforcement

   After a week or two of clean reports, edit the record and change p=none to p=quarantine, then later p=reject, once you are sure your real mail passes.

SPF include values by email provider#

The host (@) and record type (TXT) are the same whoever hosts your mail. What changes is the include value inside the SPF record, and the enforcement rule each provider recommends at the end. Always confirm the current value on your provider's own help page — these move.

Why does GoDaddy show two SPF records?#

This is the single most common GoDaddy failure. When you set up GoDaddy email, GoDaddy may create an SPF record for you (include:secureserver.net). Later you add a second SPF record for a newsletter or CRM tool — and now the domain has two.

Receiving servers cannot choose between two SPF records, so they return a permerror and your mail can fail. The fix is not to delete one source; it is to merge every source into a single record, combining the include values on one line.

What to do when it doesn't work#

Most GoDaddy SPF and DMARC problems come down to five causes. Match your symptom below, then re-check the record with a free public SPF or DMARC lookup tool once you have made the change.

A faster way to catch spoofed mail after your records are live#

Setting SPF and DMARC at GoDaddy protects the mail you send. It does nothing about the spoofed and phishing mail that lands in your own inbox — that is a receiving-side job. When a message arrives, your mail app can read whether it passed SPF, DKIM, and DMARC alignment, and treat the failures accordingly.

AI Emaily does exactly that: it reads those authentication results on incoming mail and weighs them, alongside sender behaviour, to keep spoofed and impersonation messages out of your inbox. It is a mail client, not a DNS tool — it will not create your GoDaddy records for you, and it does not monitor your DMARC aggregate reports; a dedicated DMARC monitoring service does that. We build AI Emaily, and it runs on a 7-day free trial (card required, nothing charged if you cancel before day seven).