Add SPF, DKIM and DMARC Records for a GoDaddy Domain With Gmail

Sending email from your own domain through Gmail looks professional, but it only works well if receiving servers can prove the messages really came from you. Without the right DNS records, your mail can land in spam, get flagged as suspicious, or fail delivery altogether. SPF, DKIM, and DMARC are the three records that solve this problem, and you can set up all three for a GoDaddy domain in under an hour.

This guide walks you through each record in plain order. You will generate the values inside Google Workspace, paste them into GoDaddy DNS, and then check that everything is working before you rely on the domain for important mail.

Quick Answer

In Google Workspace Admin, turn on Gmail authentication to generate your DKIM key, then add a TXT record in GoDaddy with that key. Add a second TXT record for SPF that includes Google’s mail servers, usually starting with v=spf1 and ending with ~all. Finally, add a DMARC TXT record at _dmarc that tells receivers how to handle mail that fails checks, starting with a monitoring policy of p=none before you make it stricter.

What These Three Records Actually Do

Each record answers a different question for the receiving server. Keeping them separate in your mind makes troubleshooting much easier later.

SPF: Which servers may send for your domain

Sender Policy Framework, or SPF, is a list published in DNS. When a message arrives, the receiving server looks up your domain and checks whether the sending server appears on that list. If it does not, the message fails SPF. SPF does not check the content of the message. It only checks the path it came from.

DKIM: A signature that proves the message was not changed

DomainKeys Identified Mail, or DKIM, adds a digital signature to the headers of every outgoing message. Your mail service signs the message with a private key, and receivers use the public key in your DNS record to verify it. If the message was altered in transit, the signature will not match.

DMARC: What to do when a check fails

DMARC ties SPF and DKIM together and adds one important rule: the domain in the visible From address must align with the domain that passed SPF or DKIM. DMARC also tells receivers what to do with failing mail and where to send reports, so you can see who is sending mail using your domain.

Before You Start

A little preparation prevents the most common delays. Gather the following before you open any settings pages:

• Admin access to your Google Workspace account, not just a regular Gmail login.
• Access to the GoDaddy account where the domain’s DNS is managed.
• Confirmation that your domain’s nameservers point to GoDaddy. If DNS is hosted elsewhere, the records must go there instead.
• A list of every other service that sends mail for your domain, such as a website contact form, a newsletter tool, or a help desk.
• About 30 to 60 minutes, plus patience for DNS changes to spread, which can take a few hours.

That last point about other senders matters a lot. SPF can only hold a limited number of lookups, and if you overwrite an existing SPF record instead of merging it, you can break mail from your other tools on the same day.

Step 1: Set Up Your SPF Record in GoDaddy

If your domain sends only through Google Workspace, your SPF record is simple. If other services also send for the domain, you need to combine them into one record, because a domain should have only one SPF record.

1. Sign in to GoDaddy and open the DNS management page for your domain.
2. Look for an existing TXT record on the root domain that starts with v=spf1. If one exists, edit it instead of creating a second one.
3. For Google only, use a value that includes Google’s sending service and ends with a soft fail, written as v=spf1 include:_spf.google.com ~all.
4. If another service sends for you, add its include statement before the ~all, keeping everything in a single line.
5. Save the record and note the time, so you know when to test it later.

Google’s own guidance on the exact SPF value is covered in the Google Workspace Admin help page on setting up SPF, which is worth checking if your setup includes extra senders.

Step 2: Generate and Publish Your DKIM Key

DKIM takes a few more clicks because the key is generated for your specific domain. You create it in Google, publish it in GoDaddy, and then switch it on back in Google.

1. In Google Admin, go to Apps, then Google Workspace, then Gmail, and open the Authenticate email section.
2. Select your domain and choose to generate a new record. The default key length is fine for most small domains.
3. Google will show you a DNS host name, usually google._domainkey, and a long TXT value. Keep this tab open.
4. In GoDaddy DNS, add a new TXT record. Paste the host name and the full key value exactly as shown, without extra spaces or line breaks.
5. Return to Google Admin and start authentication. Google will check DNS, which may fail at first if the record has not spread yet.
6. Wait and try again later if verification fails immediately. Once Google accepts the record, DKIM signing is active.

If the long key value does not fit neatly in GoDaddy’s field, do not shorten it. A shortened key will never verify. GoDaddy’s own instructions on adding TXT records are explained in the GoDaddy help guide for adding a TXT record, including where the host field should and should not include your full domain name.

Step 3: Add a DMARC Record

Only add DMARC after SPF and DKIM are in place and tested. DMARC builds on both, and publishing it too early can cause real mail to be rejected.

1. In GoDaddy DNS, add a TXT record with the host name _dmarc.
2. Start with a monitoring value such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, using a mailbox you actually check.
3. Save the record and send several test messages over the next few days.
4. Read the reports that arrive. They show which services send for your domain and whether they pass alignment.
5. Once everything legitimate passes, move to a stronger policy such as p=quarantine, and later p=reject if you are confident nothing is missing.

Do not jump straight to p=reject on day one. Legitimate forwarding, mailing lists, and older tools often fail alignment in ways you will only discover from the reports.

How to Test All Three Records

Testing is not optional. A record can look correct in GoDaddy and still fail because of a typo, a duplicate, or a formatting problem.

• Send a message from your domain address to a personal Gmail account you control.
• Open the message, use the option to view the original message, and look for SPF, DKIM, and DMARC pass results in the headers.
• Check that the DKIM domain shown matches your own domain, not a shared service domain.
• Repeat the test after any DNS change, and allow time for the change to spread before judging the result.

If DKIM does not show as passing, work through the checks in our guide about verifying your DKIM record is working, which covers the most common reasons a correct-looking record still fails.

Common Mistakes to Avoid

• Creating two SPF records. A domain must have one SPF record. Two records can cause a permanent error and make SPF fail for everyone.
• Using -all too early. A hard fail ending can reject mail from a sender you forgot to list. Start with ~all and tighten later.
• Copying only part of the DKIM key. The value is long on purpose. Missing characters break the signature completely.
• Adding your domain twice in the host field. Some DNS panels append the domain automatically, so google._domainkey can become google._domainkey.yourdomain.com.yourdomain.com.
• Publishing DMARC with reject before monitoring. You lose the chance to discover legitimate senders that need fixing first.
• Testing too soon. DNS changes are not instant. A failed test five minutes after saving a record proves very little.

Conclusion

SPF lists who may send for your domain, DKIM signs your messages so they cannot be quietly changed, and DMARC tells receivers how to handle mail that fails and reports the results back to you. Set them up in that order in GoDaddy and Google Workspace, start DMARC in monitoring mode, and test with real messages before tightening any policy. Done carefully, this one setup protects your domain’s reputation and keeps your Gmail messages out of spam folders.

Frequently Asked Questions

How long do the DNS changes take to work?

Most GoDaddy changes appear within an hour or two, but full propagation can take up to 48 hours in rare cases. Test after a reasonable wait, and do not keep editing the record while you wait, because each edit can restart confusion about which version you tested.

Can I use these records with a free Gmail account?

No. DKIM signing for your own domain is a Google Workspace feature controlled by an admin. A free Gmail account sending as another address does not give you the same authentication control, and receivers will treat that mail less favourably.

What happens if I already have an SPF record for my website?

Edit that existing record and add Google’s include statement to it. Never add a second SPF record alongside it. One combined record covering every legitimate sender is the correct approach.

Do I need DMARC if SPF and DKIM already pass?

Yes, DMARC adds alignment checking and a published policy, and many large receivers now expect it. Without DMARC, a scammer can still use your visible From domain in ways that SPF and DKIM alone do not stop.

Which DMARC policy should I use in the long term?

Most domains should aim for p=reject once monitoring shows all legitimate mail passing. Move through p=none and p=quarantine first, over days or weeks, so the change never surprises you with lost mail.