DNS help › GoDaddy

How to add SPF, DKIM and DMARC records in GoDaddy

If you bought your domain from GoDaddy and it still uses GoDaddy's nameservers, you manage your DNS records in your GoDaddy Domain Portfolio.

This guide shows where to find your DNS settings, how to add or change a record, and what the main email records do.

Before you start

GoDaddy's help explains that you only manage DNS at GoDaddy if your domain uses GoDaddy nameservers. If it points elsewhere, add the records with that provider.

Step 1: Log in and find your DNS settings

1. Sign in to your GoDaddy Domain Portfolio.
2. Select the domain to open its Domain Settings page.
3. Select DNS to see your DNS records.

Step 2: Add a TXT record

1. Select Add New Record, then choose TXT from the Type menu.
2. In Name, enter the host without your domain name (use @ for the domain itself).
3. In Value, paste the record text.
4. Leave TTL on the default (1 hour).
5. Select Save.
6. If your domain has GoDaddy's Domain Protection, you'll be asked for a verification code before the change goes through.

About the Name field: GoDaddy adds your domain name for you. Type only the prefix, for example _dmarc, not _dmarc.yourbusiness.co.uk, or you'll end up with the domain twice.

Changing an existing record

To change a record, open DNS as above and select Edit next to the TXT record. Update the value and select Save.

Adding a CNAME record

For a CNAME record (Microsoft 365 uses these for DKIM), use Add New Record and choose CNAME. Again, enter only the prefix in the Name, not the full domain.

The same steps work for the Tidy Cyber ownership record: Name _tidycyber-verify, with the code we show you when you verify. The code is unique to you and your domain.

Step 3: Understand your email records

These are the records our check looks at. If one already exists, it usually needs editing rather than adding another.

SPF: say who can send email for you

SPF is a single TXT record on your domain that lists the services allowed to send email as you, such as your email provider, newsletter tool or invoicing system. Without it, it's much easier for a scammer to send email that looks like it came from you.

A domain can only have one SPF record, so if you already have one, it needs editing rather than adding a second. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DMARC: tell the world what to do with fakes

DMARC is a TXT record that tells other mail servers what to do with email that fails the SPF and DKIM checks, and can send you reports about who is sending email using your name.

It's best introduced gently: first just watching, then gradually asking receivers to junk and then refuse fake email, once you're sure your genuine email passes. Our free check flags a watch-only policy as a high risk, because fakes are still delivered. The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

DKIM: sign your emails

DKIM adds a digital signature to the email you send, so receivers can tell it really came from you and wasn't changed on the way. Your email provider creates the key and you publish it in your DNS, as a TXT record or as CNAME records depending on the provider. You can't make up a DKIM value yourself.

In Google Workspace, DKIM lives in the Google Admin console under Gmail's Authenticate email settings. In Microsoft 365, it's on the DKIM tab of the Email authentication settings in the Microsoft Defender portal (see our Microsoft 365 guide). Newsletter tools and booking systems usually have their own DKIM settings. For a CNAME record (Microsoft 365 uses these for DKIM), use Add New Record and choose CNAME. Again, enter only the prefix in the Name, not the full domain.

The right value depends on your email provider and how your domain is set up today, so we don't list generic ones here. The full report gives the exact records for your domain.

Domains that don't send email

Spare and old domains you never email from can still be used to fake email in your name, so they need locking down too, in a slightly different way from a domain you do use. The full report checks for this and gives the exact records for that domain.

Optional: DNSSEC

DNSSEC adds tamper protection to your DNS records. Our check reports it as a low-priority item. GoDaddy offers DNSSEC for domains using GoDaddy nameservers; it's in the DNS area of your domain. Whether it applies to your domain depends on your provider and domain ending; the full report tells you.

Check it worked

GoDaddy says most DNS updates take effect within an hour, but can take up to 48 hours. Once you think the change has gone through:

1. Go to the free Tidy Cyber check and enter your domain.
2. Look at your results. The issue you fixed should no longer appear in your top issues (or should show a lower risk).
3. If nothing has changed, wait a little longer and check again. If it still hasn't changed after a day, check the record's Name and Value character by character. A missing character or a doubled domain name is the usual cause.

The free check is passive: it only looks at what your domain already shows the world, and nothing is installed.

Official GoDaddy help

We checked these steps against the official guides in October 2026. Screens do change, so if something looks different, follow the provider's own guide:

• Add a TXT record
• Edit a TXT record
• Turn DNSSEC on or off

← All DNS guides