GoDaddy DMARC Record: Add It Step by Step

Where do you add a DMARC record for a GoDaddy domain?

You add the DMARC record wherever your domain's DNS is actually hosted. That isn't always where you bought the domain. If the domain uses GoDaddy's nameservers, you add the record on GoDaddy's DNS page. If the nameservers point somewhere else, like Cloudflare or your web host, GoDaddy's DNS page has no effect and the record has to go with that provider. The domain's settings in GoDaddy show which nameservers are active. You can also run dig NS yourdomain.com from a terminal and read the answer.

Under the DMARC specification published by the IETF, a receiving server looks up one TXT record at _dmarc.yourdomain.com, where yourdomain.com is the domain in the visible From address. Nothing else counts. A record on the root domain, or on mail.yourdomain.com, won't be read for mail sent From yourdomain.com. GoDaddy's help centre has separate DMARC articles for its own Professional Email and Microsoft 365 mailboxes, but the record itself is the same TXT entry no matter which mailbox provider sends your mail.

DMARC setup: how to add a GoDaddy DMARC record step by step

A DMARC setup has a fixed order: first SPF and DKIM for every service that sends From your domain, then a monitoring DMARC record, then reading the reports, and only then enforcement. The steps below cover the record itself and follow the flow GoDaddy's help centre describes for adding a TXT record. GoDaddy changes menu labels now and then, so if a button has a different name, look for the DNS or DNS records page for the domain.

1. 1 Sign in to GoDaddy and open your Domain Portfolio.
2. 2 Select the domain and open its DNS page, which lists the existing records.
3. 3 Look for a TXT record whose name is _dmarc. If there is one, edit it instead of adding a second one.
4. 4 Choose Add New Record and set the type to TXT.
5. 5 In the Name (Host) field enter only _dmarc. GoDaddy adds your domain on its own.
6. 6 In the Value field paste your policy, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
7. 7 Leave the TTL at its default unless you have a reason to change it, then save.
8. 8 Check from outside GoDaddy with dig TXT _dmarc.yourdomain.com +short, or with a public DNS lookup tool. The answer should be a single string that starts with v=DMARC1.

DMARC passes only when SPF or DKIM passes and aligns with the From domain, so a record published before those two are in place mostly produces failure rows. Our SPF, DKIM and DMARC checker reads all three records for a domain in one lookup.

DMARC record example for a GoDaddy domain

A DMARC record example is easiest to read as three stages of one rollout. The Name stays _dmarc the whole time and only the Value changes. The tag meanings come from the DMARC specification.

Stage	Value of the _dmarc TXT record	What receivers do
Monitor	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com	Deliver as usual, but send aggregate reports to the rua address
Quarantine	v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com	Treat failing mail as suspicious, which usually means the spam folder. An optional pct tag limits this to a share of failing mail
Reject	v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com	Ask receivers to refuse mail that fails DMARC

p=none doesn't block anything, so it won't stop someone spoofing your domain. Its job is to produce reports. If you stay at p=none forever, you get visibility but no enforcement.

Which DMARC tags matter in the record?

The DMARC specification defines a short list of DMARC tags. Only v and p are required, and v must come first. Any tag you leave out takes the default the specification sets for it.

Tag	What it sets	Default if omitted
v	Protocol version, always DMARC1	Required
p	Policy for the domain: none, quarantine or reject	Required
sp	Policy for subdomains	Same as p
rua	Address(es) for aggregate XML reports	No aggregate reports
ruf	Address(es) for per-message failure reports	No failure reports
pct	Share of failing mail the policy applies to	All failing mail
adkim	DKIM alignment: r (relaxed) or s (strict)	r
aspf	SPF alignment: r (relaxed) or s (strict)	r
fo	When failure reports are generated	Only when all checks fail to align
ri	Requested aggregate report interval in seconds	One day

Relaxed alignment means a subdomain such as mail.yourdomain.com still aligns with yourdomain.com. Strict alignment needs an exact match. Many large receivers ignore ruf for privacy reasons, so don't count on failure reports arriving. Our DMARC setup guide covers each tag in more depth, including how sp behaves on subdomains.

What goes wrong with a GoDaddy DMARC record?

• Full domain in the Name field: entering _dmarc.yourdomain.com can publish the record at _dmarc.yourdomain.com.yourdomain.com, where no receiver will look. Enter _dmarc only.
• Two DMARC records: under the DMARC specification, if the lookup returns more than one DMARC record, the receiver skips DMARC entirely. Merge them into one.
• Wrong nameservers: the record is on GoDaddy's DNS page, but the domain resolves through another provider, so the public lookup returns nothing.
• Report address on another domain: if rua points to a mailbox at a different domain, that domain has to publish an authorisation TXT record at yourdomain.com._report._dmarc.thatdomain.com. Without it, receivers may not send reports there.
• Typos in the value: a missing semicolon, a space inside mailto:, or DMARC instead of DMARC1 makes the record invalid.
• Going to reject too early: a sender you forgot about, such as a CRM, an invoicing tool or a newsletter platform, starts failing and its mail is refused.

How do you read DMARC reports?

Aggregate reports arrive at the rua address as compressed XML attachments, usually one per receiver per day. Each report has a header naming the receiver and the date range, then the policy it saw in your record, then one row for each sending IP.

• source_ip: the server that sent the mail. Look it up to see whether it's Google, Microsoft, Brevo or something you don't recognise.
• count: how many messages came from that IP in the period.
• disposition: what the receiver did with them (none, quarantine, reject).
• dkim and spf under policy_evaluated: whether each one passed and aligned with the From domain. This is the DMARC verdict.
• auth_results: the raw SPF and DKIM results, including which domain signed. A DKIM pass for a domain other than yours is why aligned DKIM can still show fail.

Rows where neither SPF nor DKIM is aligned tell you what to fix before you tighten p. Our article on how to read DMARC reports goes through a sample XML file field by field.

Google Workspace on a GoDaddy domain: SPF and DMARC

What is the Google SPF record?

Google's Workspace admin help gives the SPF record as a TXT record on the root domain with the value v=spf1 include:_spf.google.com ~all. In GoDaddy the Name is @. A domain can have only one SPF record. If you also send through Brevo or another service, add their include to the same record instead of creating a second v=spf1 entry, because two SPF records produce a permerror. SPF also caps the number of DNS lookups an evaluation may trigger, so a long chain of includes can break SPF even when every include is correct. Our Google Workspace DNS records article covers MX, SPF and DKIM together.

How does DMARC work for Google Workspace?

Google Workspace doesn't publish DMARC for you. You add the same _dmarc TXT record in GoDaddy. For Workspace mail to pass DMARC through DKIM, turn on DKIM signing in the Google Admin console and publish the google._domainkey TXT record it generates. Without your own DKIM key, Workspace mail can only pass DMARC through SPF alignment. Google's email sender guidelines require bulk senders to Gmail to publish DMARC. Our Google Workspace DMARC rollout guide also covers domains that send through Brevo.

DMARC when EmailFlow OS sends through your own Brevo account

EmailFlow OS is built around the domain you already own. You record one video and upload it to EmailFlow OS, connect your Brevo account and sending domain, and import your prospect list into EmailFlow OS. It then creates a personalised version of that one recording for each recipient, not each company, and sends every version from your own inbox, through your own Brevo account and your own sending domain. Nothing goes out through a shared platform sender.

So the GoDaddy DMARC record you publish is the one receivers check for those emails, because the From domain is yours. For that mail to align through DKIM, Brevo has to sign it for your domain, which means the Brevo DKIM records also have to be at GoDaddy. Our GoDaddy DKIM setup for Brevo walks through those records. The aggregate reports then show Brevo's IPs next to your Workspace or Microsoft 365 rows, and you can confirm those rows are aligned before you move to quarantine. Whether a message reaches the inbox is still up to the receiving server. You can read more about how EmailFlow OS sends personalised video email on the home page.

Questions people ask

? How long does a GoDaddy DMARC record take to work?

Once you save it, the record is live on GoDaddy's nameservers. Resolvers that cached an earlier answer for _dmarc keep it until that answer's TTL runs out. Run dig TXT _dmarc.yourdomain.com against a public resolver to see what receivers see. The first aggregate reports usually arrive after a full reporting period, which defaults to one day under the DMARC specification.

? Is the G Suite SPF record different from the Google Workspace SPF record?

No. G Suite is the old name for Google Workspace, and the SPF record is the same: v=spf1 include:_spf.google.com ~all as one TXT record on the root domain, per Google's admin help. If your domain still has an older G Suite SPF entry, keep just one v=spf1 record and merge any other senders' includes into it.

? Can I have two DMARC records on one GoDaddy domain?

No. The DMARC specification says that if a DMARC lookup returns more than one record, the receiver doesn't apply DMARC to that domain at all. This often happens when a mailbox provider's setup wizard adds a record next to one you wrote yourself. Delete one and merge the tags you need into the other.

? Should a cold email domain start at p=reject?

Not usually. p=reject asks receivers to refuse anything that fails, and that includes legitimate mail from a sender you haven't aligned yet. Starting at p=none gives you aggregate reports that list every sending IP. Once every legitimate row shows aligned SPF or DKIM, you can move through quarantine to reject.