SPF, DKIM and DMARC for GoDaddy email (Microsoft 365 and Professional Email)

Short answer: GoDaddy email (Microsoft 365 and Professional Email) mail passes Gmail, Yahoo and Microsoft checks when you turn on DKIM with your own domain, add include:secureserver.net to your one SPF record and publish a DMARC record at _dmarc (start with p=none). The exact records and clicks are below.

SPF	TXT at `@`	v=spf1 include:secureserver.net ~all GoDaddy's own value is `v=spf1 include:secureserver.net -all` for both Microsoft 365 from GoDaddy and Professional Email. If the domain, DNS and email are in the same GoDaddy account, GoDaddy adds it for you. With the Advanced Email Security add-on the value is different: check the Email & Office Dashboard. Combine with your other senders →
DKIM	CNAME / TXT	Professional Email (powered by Titan): two CNAMEs, `secureserver1._domainkey` and `secureserver2._domainkey`, with the targets the Email & Office Dashboard shows (they look like `s1.dkim.yourdomain_com.xxx.onsecureserver.net`). Microsoft 365 from GoDaddy: two CNAMEs that Microsoft generates in the Defender portal, then you switch signing on.
DMARC	TXT at `_dmarc`	v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com Start with `p=none` and a mailbox you read, or a free report address that turns the reports into a dashboard; build your own.

Step by step

Check which product you have in the Email & Office Dashboard: Microsoft 365 from GoDaddy or Professional Email.
Make sure the domain has one SPF record at @ with include:secureserver.net; add your other senders (newsletter, shop) to that same record.
Professional Email: in the dashboard go to Users → Manage → Set mail destination (or the Help me fix this banner). Step 2 lists the two DKIM CNAMEs and step 5 the SPF and DMARC records; add them in DNS.
Microsoft 365 from GoDaddy: in the Microsoft 365 Defender portal open DKIM, pick the domain, click Create DKIM keys, add the two CNAMEs in DNS, then turn on Sign messages for this domain with DKIM signatures.
Add DMARC at _dmarc after SPF and DKIM. GoDaddy's dashboard suggests a p=quarantine record; if other services also send as you, start with p=none and move up once the reports are clean.

Mistakes that break it

DNS not at GoDaddy (Cloudflare, for example)? GoDaddy can't add anything for you: copy every record to your DNS host.
Professional Email bought from GoDaddy is not set up like Titan bought elsewhere. Use the secureserver records here, not the Titan ones.
A second SPF record (from an old host or a marketing tool) breaks delivery. Merge everything into one.
Microsoft 365 with Advanced Email Security (Proofpoint) needs an extra DKIM TXT record from the Advanced Email Security portal on top of the Microsoft ones.

Check that it worked

After the fix, keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.

Other setup guides

Google Workspace · Microsoft 365 · Zoho Mail · Hostinger Email · Titan Email · Proton Mail · Cloudflare Email Routing · Mailchimp · SendGrid · Amazon SES · Shopify Email · Klaviyo · HubSpot · Brevo · Mailgun · Postmark · Zendesk · Constant Contact · MailerLite · Kit (ConvertKit)