How to add a DKIM record in GoDaddy DNS

To add a DKIM record in GoDaddy, first get the hostname, value, and record type from the service that sends your mail. In GoDaddy Domain Portfolio, open the domain's DNS settings, choose Add New Record, enter those account-generated values, and save. Do not copy a selector, public key, or CNAME target from another domain: a sender can require either TXT or CNAME records, and the exact values belong to that sending path.

What should I check before configuring GoDaddy DNS?

This guide covers a domain whose authoritative DNS is managed in GoDaddy. GoDaddy says DNS records can be managed in its account when the domain uses GoDaddy nameservers; otherwise, the records are managed at the active DNS or hosting provider. Confirm that boundary before editing anything in GoDaddy's DNS-record guide.

You also need access to the sending service that generated the DKIM setup. Get the record type, host or name, value or target, and the number of records from that service. GoDaddy's own hosting-email instructions show a TXT DKIM record, while its Microsoft 365 guide shows two generated CNAME records. That difference is why a generic DKIM value is unsafe to publish.

Copy DNS values only from the sending account and domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another account or from an online example.

Which setup method should I use?

Use a TXT record when the sending service gives you a DKIM public-key value. Use CNAME when it gives you a CNAME hostname and destination, often as a pair. GoDaddy documents both record types in Manage DNS records, but it does not convert one sender's method into the other.

If your sender has a separate verification or enable step, keep it open until the DNS records resolve. For example, GoDaddy's Microsoft 365 instructions require generating two CNAME records, saving them in GoDaddy DNS, and then enabling DKIM in Microsoft 365 after the records are detected.

How do I set up a DKIM record in GoDaddy?

1. Collect the sender-generated DKIM records

Open the authentication or domain settings for the service that sends the affected mail. Copy each required record's type, Name or Host, and Value or Target. DKIM uses a selector to locate the public key below _domainkey; RFC 6376 defines that selector-based lookup. The sender, not GoDaddy, chooses the selector and key material.

2. Open the domain's DNS settings

Sign in to GoDaddy Domain Portfolio, select the domain, and choose DNS under the domain name. That is the current path in GoDaddy's hosting-email DKIM instructions. If the domain does not use GoDaddy nameservers, stop here and update the authoritative DNS provider instead.

3. Add each required record

Choose Add New Record. Select the sender-required type, enter its supplied Name and Value, leave TTL at the sender or GoDaddy-recommended setting, and save the record. GoDaddy documents TXT, Name, Value, default TTL, and Save All Records for its hosting-email DKIM flow; its Microsoft 365 workflow uses the same fields with CNAME and repeats the process for the second record.

Illustrative structure only. Do not publish this as a record:

Type: <TXT or CNAME, exactly as required by the sender>
Name: <selector>._domainkey
Value: <sender-generated public-key value or CNAME target>

Do not replace the brackets with a guessed value. Copy the account-generated value from your sender. If GoDaddy appends the zone name to the Name field, enter only the host label supplied by the sender rather than a duplicated full domain name.

4. Save every DKIM record before enabling the sender

If the sender gives you two CNAME records, add both before returning to the sender's verification page. GoDaddy's Microsoft 365 DKIM guide instructs administrators to use Add More Records, save both CNAME records, and only then enable DKIM in the sending platform. A sender that uses one TXT record has a different completion path.

5. Enable or verify DKIM in the sending service

Return to the service that generated the values and use its verification or enable action. GoDaddy's Microsoft 365 example enables the signing toggle only after DNS detection. Treat that vendor status as a sender-side check, not proof that a real message is being signed.

How does this setup affect DMARC?

Publishing a DKIM record makes the public key reachable for the selector. It does not itself cause mail to be signed or guarantee DMARC pass. For DMARC's DKIM path, a receiver needs a valid DKIM result whose signing domain aligns with the visible From domain. See DKIM alignment troubleshooting before changing a DMARC policy because a passing key lookup cannot diagnose an unaligned d= value.

How do I validate the setup?

Check public DNS

Query the full selector name that your sender supplied, not merely the organizational domain. For TXT DKIM, check the TXT answer. For CNAME DKIM, check the CNAME and then the final target's DKIM key answer. Check the DKIM record after the record is public.

dig +short TXT selector._domainkey.example.com
dig +short CNAME selector1._domainkey.example.com

GoDaddy says most DNS changes take effect within an hour but can take up to 48 hours to update globally. If answers differ, compare the authoritative DNS answer and more than one public resolver before editing again.

Check the sender status

In the sending service, look for its verification or signing status after public DNS resolves. A green status only shows what that service detected. It does not replace a test message from the same production route.

Inspect a delivered message

Send a fresh message through the exact application or service you configured. In the received source, confirm a DKIM-Signature contains the expected d= and s= values, then find a receiver-added Authentication-Results result such as dkim=pass. RFC 8601 explains that authentication results are useful only within the receiver's trust boundary, so do not trust a lookalike header added by an upstream sender.

Review DMARC reports

After the sender has traffic, review DMARC aggregate reports or monitoring for the visible From domain. Compare the DKIM signing domain with that From domain and investigate any DKIM-pass, DMARC-fail result as an alignment issue rather than a DNS-record issue. What is DKIM? provides the record and signature context.

Troubleshooting

The record does not resolve

Check that GoDaddy is authoritative for the domain, the selector matches the sender's record, and the Name field did not receive the domain suffix twice. If no usable answer appears after propagation, follow the no DKIM record guide with the exact selector and domain.

The sender cannot verify a CNAME DKIM record

Confirm that every required CNAME record was saved and that the host and destination came from the same sender account. For a two-record setup, an incomplete pair cannot satisfy the sender's DNS check. Do not substitute a TXT public key for a CNAME target.

DNS resolves but the message has no DKIM pass

The DNS publication may be correct while the application is not signing with the matching private key, is using a different selector, or the test used another sending route. Compare the fresh message's d= and s= values with the sender configuration before changing DNS.

DKIM passes but DMARC still fails

DKIM can be cryptographically valid while its d= domain does not align with the visible From domain. Use the DKIM alignment guide to separate alignment from key publication.

Check the published selector before changing more DNS

Once you have the selector and domain, run them through Palisade's DKIM checker to inspect the public record that resolvers can see.

Check the DKIM record

The checker can inspect public DNS. It cannot access a private key, enable a sender's DKIM setting, prove that an unseen message was signed, or change GoDaddy DNS.

Keep sender changes visible after the DNS check

The DKIM checker confirms one published selector. If several services send as the domain, a later sender or alignment change can remain outside that one record check. Palisade's DMARC Agent turns DMARC aggregate-report findings into source-specific authentication tickets and recommended actions for human review. It cannot change GoDaddy DNS, enable a sender, or guarantee delivery.

Start with Palisade