# How to add a DKIM record in GoDaddy DNS > Add the DKIM TXT or CNAME records generated by your sending service in GoDaddy Domain Portfolio, then verify DNS, signing, and DMARC alignment. To add a DKIM record in GoDaddy, first get the hostname, value, and record type from the service that sends your mail. In GoDaddy Domain Portfolio, open the domain's DNS settings, choose **Add New Record**, enter those account-generated values, and save. Do not copy a selector, public key, or CNAME target from another domain: a sender can require either TXT or CNAME records, and the exact values belong to that sending path. ## Quick takeaways - GoDaddy is the DNS publisher in this workflow. Your email sender generates the DKIM values. - Select the record type the sender specifies. TXT and CNAME DKIM setups are not interchangeable. - Enter the host label and value exactly as generated for the domain you are configuring. - A saved DNS record is only one check. Confirm the sender detects it, then inspect a newly delivered message. - DKIM can pass without satisfying DMARC if the signing `d=` domain does not align with the visible From domain. ## What should I check before configuring GoDaddy DNS? This guide covers a domain whose authoritative DNS is managed in GoDaddy. GoDaddy says DNS records can be managed in its account when the domain uses GoDaddy nameservers; otherwise, the records are managed at the active DNS or hosting provider. Confirm that boundary before editing anything in [GoDaddy's DNS-record guide](https://www.godaddy.com/en-uk/help/manage-dns-records-680?isc=gtnieu114). You also need access to the sending service that generated the DKIM setup. Get the record type, host or name, value or target, and the number of records from that service. GoDaddy's own hosting-email instructions show a TXT DKIM record, while its Microsoft 365 guide shows two generated CNAME records. That difference is why a generic DKIM value is unsafe to publish. > Copy DNS values only from the sending account and domain you are configuring. Do not publish selectors, targets, tokens, or hostnames from another account or from an online example. ## Which setup method should I use? Use a TXT record when the sending service gives you a DKIM public-key value. Use CNAME when it gives you a CNAME hostname and destination, often as a pair. GoDaddy documents both record types in [Manage DNS records](https://www.godaddy.com/en-uk/help/manage-dns-records-680?isc=gtnieu114), but it does not convert one sender's method into the other. If your sender has a separate verification or enable step, keep it open until the DNS records resolve. For example, GoDaddy's Microsoft 365 instructions require generating two CNAME records, saving them in GoDaddy DNS, and then enabling DKIM in Microsoft 365 after the records are detected. ## How do I set up a DKIM record in GoDaddy? ### 1. Collect the sender-generated DKIM records Open the authentication or domain settings for the service that sends the affected mail. Copy each required record's type, Name or Host, and Value or Target. DKIM uses a selector to locate the public key below `_domainkey`; [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376) defines that selector-based lookup. The sender, not GoDaddy, chooses the selector and key material. ### 2. Open the domain's DNS settings Sign in to GoDaddy Domain Portfolio, select the domain, and choose **DNS** under the domain name. That is the current path in GoDaddy's [hosting-email DKIM instructions](https://www.godaddy.com/en-uk/help/set-up-spf-dkim-or-dmarc-records-for-my-hosting-email-40810). If the domain does not use GoDaddy nameservers, stop here and update the authoritative DNS provider instead. ![GoDaddy Domain Portfolio with an individual domain selected](/images/editorial/add-dkim-record-godaddy/godaddy-select-domain.png "300x293") *Source: [GoDaddy's current DNS-record instructions](https://www.godaddy.com/help/add-or-edit-an-a-record-42546), captured from the official documentation on July 29, 2026.* ![GoDaddy domain settings with the DNS tab highlighted](/images/editorial/add-dkim-record-godaddy/godaddy-select-dns-tab.png "300x209") *Source: [GoDaddy's current DNS-record instructions](https://www.godaddy.com/help/add-or-edit-an-a-record-42546), captured from the official documentation on July 29, 2026.* ### 3. Add each required record Choose **Add New Record**. Select the sender-required type, enter its supplied Name and Value, leave TTL at the sender or GoDaddy-recommended setting, and save the record. GoDaddy documents **TXT**, **Name**, **Value**, default TTL, and **Save All Records** for its hosting-email DKIM flow; its Microsoft 365 workflow uses the same fields with **CNAME** and repeats the process for the second record. **Illustrative structure only. Do not publish this as a record:** ```text wrap Type: Name: ._domainkey Value: ``` Do not replace the brackets with a guessed value. Copy the account-generated value from your sender. If GoDaddy appends the zone name to the Name field, enter only the host label supplied by the sender rather than a duplicated full domain name. ### 4. Save every DKIM record before enabling the sender If the sender gives you two CNAME records, add both before returning to the sender's verification page. GoDaddy's [Microsoft 365 DKIM guide](https://www.godaddy.com/nl/help/enable-and-add-dkim-to-my-domain-for-microsoft-365-41748?lc=en-US) instructs administrators to use **Add More Records**, save both CNAME records, and only then enable DKIM in the sending platform. A sender that uses one TXT record has a different completion path. ### 5. Enable or verify DKIM in the sending service Return to the service that generated the values and use its verification or enable action. GoDaddy's Microsoft 365 example enables the signing toggle only after DNS detection. Treat that vendor status as a sender-side check, not proof that a real message is being signed. ## How does this setup affect DMARC? Publishing a DKIM record makes the public key reachable for the selector. It does not itself cause mail to be signed or guarantee DMARC pass. For DMARC's DKIM path, a receiver needs a valid DKIM result whose signing domain aligns with the visible From domain. See [DKIM alignment troubleshooting](/learning/why-does-my-dkim-signature-fail-alignment) before changing a DMARC policy because a passing key lookup cannot diagnose an unaligned `d=` value. ## How do I validate the setup? ### Check public DNS Query the full selector name that your sender supplied, not merely the organizational domain. For TXT DKIM, check the TXT answer. For CNAME DKIM, check the CNAME and then the final target's DKIM key answer. [Check the DKIM record](/tools/dkim) after the record is public. ```bash dig +short TXT selector._domainkey.example.com dig +short CNAME selector1._domainkey.example.com ``` GoDaddy says most DNS changes take effect within an hour but can take up to 48 hours to update globally. If answers differ, compare the authoritative DNS answer and more than one public resolver before editing again. ### Check the sender status In the sending service, look for its verification or signing status after public DNS resolves. A green status only shows what that service detected. It does not replace a test message from the same production route. ### Inspect a delivered message Send a fresh message through the exact application or service you configured. In the received source, confirm a `DKIM-Signature` contains the expected `d=` and `s=` values, then find a receiver-added `Authentication-Results` result such as `dkim=pass`. [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html) explains that authentication results are useful only within the receiver's trust boundary, so do not trust a lookalike header added by an upstream sender. ### Review DMARC reports After the sender has traffic, review DMARC aggregate reports or monitoring for the visible From domain. Compare the DKIM signing domain with that From domain and investigate any DKIM-pass, DMARC-fail result as an alignment issue rather than a DNS-record issue. [What is DKIM?](/learning/what-is-dkim) provides the record and signature context. ## Troubleshooting ### The record does not resolve Check that GoDaddy is authoritative for the domain, the selector matches the sender's record, and the Name field did not receive the domain suffix twice. If no usable answer appears after propagation, follow the [no DKIM record guide](/learning/no-dkim-record-found) with the exact selector and domain. ### The sender cannot verify a CNAME DKIM record Confirm that every required CNAME record was saved and that the host and destination came from the same sender account. For a two-record setup, an incomplete pair cannot satisfy the sender's DNS check. Do not substitute a TXT public key for a CNAME target. ### DNS resolves but the message has no DKIM pass The DNS publication may be correct while the application is not signing with the matching private key, is using a different selector, or the test used another sending route. Compare the fresh message's `d=` and `s=` values with the sender configuration before changing DNS. ### DKIM passes but DMARC still fails DKIM can be cryptographically valid while its `d=` domain does not align with the visible From domain. Use the [DKIM alignment guide](/learning/why-does-my-dkim-signature-fail-alignment) to separate alignment from key publication. ## Check the published selector before changing more DNS Once you have the selector and domain, run them through Palisade's DKIM checker to inspect the public record that resolvers can see. [Check the DKIM record](/tools/dkim) The checker can inspect public DNS. It cannot access a private key, enable a sender's DKIM setting, prove that an unseen message was signed, or change GoDaddy DNS. ## Keep sender changes visible after the DNS check The DKIM checker confirms one published selector. If several services send as the domain, a later sender or alignment change can remain outside that one record check. Palisade's [DMARC Agent](https://docs.palisade.email/guides/fixing-authentication-issues/) turns DMARC aggregate-report findings into source-specific authentication tickets and recommended actions for human review. It cannot change GoDaddy DNS, enable a sender, or guarantee delivery. [Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=vendor_setup&utm_content=add-dkim-record-godaddy) ## Sources and further reading - [GoDaddy: Manage DNS records](https://www.godaddy.com/en-uk/help/manage-dns-records-680?isc=gtnieu114) - [GoDaddy: Set up SPF, DKIM, or DMARC records for hosting email](https://www.godaddy.com/en-uk/help/set-up-spf-dkim-or-dmarc-records-for-my-hosting-email-40810) - [GoDaddy: Enable and add DKIM to Microsoft 365](https://www.godaddy.com/nl/help/enable-and-add-dkim-to-my-domain-for-microsoft-365-41748?lc=en-US) - [RFC 6376: DomainKeys Identified Mail](https://www.rfc-editor.org/rfc/rfc6376) - [RFC 8601: Authentication-Results](https://www.rfc-editor.org/rfc/rfc8601.html) ## Frequently asked questions ### Is a DKIM record always a TXT record? No. Some senders publish the DKIM public key in a TXT record, while others require CNAME records that lead to provider-managed key material. Use the type generated by the sender. ### Can I use the same DKIM selector for every sender? Only if the sending services explicitly coordinate that selector and key. Different services commonly use separate selectors, so copying one sender's record over another can break verification. ### Does saving the record in GoDaddy enable DKIM? No. Saving publishes DNS. The sending service must also use the matching private key and may require a separate verification or enable action. ### How long should I wait after adding the record? GoDaddy says DNS changes often take effect within an hour but can take up to 48 hours globally. Check the published selector before retrying the sender's verification step. ### Can a DKIM pass still fail DMARC? Yes. A passing DKIM signature must also align with the visible From domain to provide a DMARC pass through DKIM.