How does spam protection work in GoDaddy Microsoft 365?

Microsoft 365 bought from GoDaddy looks different from Microsoft 365 bought from Microsoft. You sign in through GoDaddy's Email & Office Dashboard, GoDaddy bills you, and GoDaddy may add its own email security layer. Underneath, though, it is a standard Microsoft tenant with Microsoft's built-in filtering.

This guide explains which layers filter your mail, where each setting lives at the time of writing (October 2026), and how to add an external spam filter safely if the built-in protection isn't catching enough.

What spam protection comes with Microsoft 365 from GoDaddy?

Microsoft 365 from GoDaddy comes with Microsoft's built-in protection, and possibly a second layer from GoDaddy. Microsoft says its built-in security features "help protect your Microsoft 365 organization from spam, malware, phishing and other email threats" and "are included in all organizations with cloud mailboxes." Admins often call this layer EOP (Exchange Online Protection); our guide What is Exchange Online Protection? covers it in depth.

The second layer is GoDaddy's Advanced Email Security add-on. GoDaddy describes it as protection "against cyber threats like spam, malware, and phishing attacks" that also adds warning banners, link and attachment checks, and quarantine for mail that appears to come from your domain but originates outside it. GoDaddy says it is "starting to include Advanced Email Security with each Microsoft 365 plan," though "you may still see the option to purchase it for your plan at an added cost" (GoDaddy Help).

Microsoft's default policies "apply to all recipients. You can't turn them off," but you can override them with the Standard or Strict preset security policies or with custom policies (Microsoft Learn).

How do I find out which layer filters my mail first?

Your domain's MX record (mail exchanger record, the DNS entry that tells the internet where to deliver your mail) shows which service receives mail first. Look it up with our MX Lookup tool.

1. If the MX ends in mail.protection.outlook.com, mail goes straight to Microsoft, and Microsoft's filtering is the only server-side layer.
2. If the MX names another provider's hosts, something sits in front of Microsoft. For GoDaddy customers that is usually Advanced Email Security: GoDaddy's move-away article says customers with the add-on must change their MX records back to Microsoft's before leaving, because the add-on's own servers receive the mail. If you aren't sure whose hosts you see, ask GoDaddy.
3. Confirm with a real message. Send yourself a test from an outside account, open the headers and paste them into the Email Header Analyzer. The Received lines show every server the message passed through.

Example MX answer for a domain that delivers straight to Microsoft (the domain is illustrative):

example.com.  3600  IN  MX  0 example-com.mail.protection.outlook.com.

Where do I change spam settings for GoDaddy Microsoft 365?

You change Microsoft's spam settings in Microsoft's admin portals, and GoDaddy's add-on settings in GoDaddy's Advanced Email Security portal. The two never share a screen.

Microsoft's settings (Exchange admin center and Defender portal)

GoDaddy's steps to reach Microsoft's admin centers are (GoDaddy Help):

1. Sign in to your Email & Office Dashboard with your GoDaddy username and password.
2. On the leftmost side, select Admin, and then Advanced.
3. Next to the admin center you want, select Sign In and enter your Microsoft 365 email address and password.

GoDaddy says "All Microsoft 365 email plans can access" the Exchange admin center. Anti-spam, anti-malware and anti-phishing policies live in the Microsoft Defender portal at security.microsoft.com. GoDaddy's help repeatedly notes that your GoDaddy username and password won't work there. Our guide to Microsoft 365 anti-spam policies walks through each setting.

GoDaddy Advanced Email Security settings

If you have the add-on, GoDaddy's steps are (GoDaddy Help):

1. Sign in to your GoDaddy Advanced Email Security page with your GoDaddy username and password.
2. Select Sign in to Advanced Email Security, then sign in with your Microsoft 365 account.
3. Under Security Settings, select Email, and then Spam Settings.
4. Adjust the sensitivity. GoDaddy says the "Default level is 7. The lower the number, the more sensitive, and the more spam that gets stopped."
5. Review the admin-only options: who can release quarantined mail, whether suspected phishing is quarantined and needs admin release, inbound domain spoofing protection, and the inbound sender DNS check.
6. Select Save.

GoDaddy says quarantined mail is kept for 30 days by default, and that a released message can take up to 24 hours to reach the inbox (GoDaddy Help).

What can individual users change?

Users who aren't admins have fewer controls, and that is deliberate. In Advanced Email Security, GoDaddy says non-admins open Administration > Spam Settings instead, and admin-wide choices apply "to all of your users, regardless of their personal spam settings" when the admin selects that option. Users can also turn their own quarantine digest emails on or off under Digests, while admins can change digest settings for everyone from Account Management > Digests (GoDaddy Help).

On the Microsoft side, each user keeps their own Junk Email settings in Outlook, including safe and blocked senders. Ask users to report missed spam and phishing with Outlook's built-in Report button rather than just deleting it, so admins see what gets through. Microsoft says the button appears only when user reporting is turned on in the Defender portal's user reported settings (Microsoft Learn). Our guide to why messages land in Junk in Microsoft 365 covers the user side.

Is the built-in protection enough for a small business?

For many small businesses, yes, as long as it is configured well. Microsoft's built-in layer rejects most spam at the connection stage, quarantines malware and high confidence phishing, and you can tighten it with the Standard or Strict presets. If you have Advanced Email Security as well, you already have two layers.

Built-in protection tends to fall short in these situations:

• Users keep reporting phishing in the inbox even after you've applied the Strict preset (see why spam gets through Microsoft 365).
• You want a personal quarantine with digest emails for every user, rather than Junk folders.
• You want mail held while Microsoft or your connectors have a problem.
• You manage several domains and want one filter and one set of rules across them.

Our comparison of Microsoft 365 built-in protection vs a gateway sets out the trade-offs in more detail, and do you need a spam filter with Microsoft 365? answers the question for any tenant.

Can I use an external spam filter with GoDaddy Microsoft 365?

Yes. Microsoft documents the setup for any Exchange Online tenant, and a GoDaddy tenant is one. GoDaddy says "All Microsoft 365 email plans can access" the Exchange admin center, where connectors live, but its help doesn't document third-party filters specifically, so confirm with GoDaddy support that nothing in your plan blocks the change. In Microsoft's words, your "domain's MX record must point to your third-party service provider," and you should lock Exchange Online down "to only accept mail from your third-party service" (Microsoft Learn).

Step by step

1. Decide on one front door. If GoDaddy's Advanced Email Security already receives your mail, choose which service should be the MX. Chaining two filters in front of Microsoft is possible but makes troubleshooting much harder. Talk to GoDaddy before removing the add-on.
2. Set up the filter first. Add your domain to the new filter and set delivery to your Microsoft host (the mail.protection.outlook.com name).
3. Create a Partner inbound connector in the Exchange admin center under Mail flow > Connectors, restricted to the filter's certificate or IP addresses.
4. Turn on Enhanced Filtering for Connectors on that connector. Microsoft calls this "highly recommended" (Microsoft Learn), because it lets Microsoft see the original sender's IP address instead of the filter's (Enhanced Filtering). Our Enhanced Filtering guide covers the settings.
5. Leave the GD connectors alone. GoDaddy says Advanced Email Security creates two encryption connectors, "GD Encryption" and "GD Encryption Integrated Inbound Return", and Email Archiving creates an "Archiving" connector (GoDaddy Help). GoDaddy doesn't say what happens if you delete them, so check with GoDaddy before you touch them.
6. Change the MX record in GoDaddy DNS. Our guide to adding email DNS records in GoDaddy shows the exact screen. Lower the TTL a day ahead and follow how to change MX records without losing email.
7. Keep SPF as it is unless the filter also sends your outbound mail. Microsoft says the standard record v=spf1 include:spf.protection.outlook.com -all is enough when all outbound mail leaves from Microsoft 365.
8. Close the bypass route once the old TTL has expired, so spammers can't deliver straight to Microsoft. See blocking direct-to-tenant bypass.
9. Test from at least two outside providers and check the headers again.

Should I move my Microsoft 365 tenant away from GoDaddy?

You don't need to move to use a different spam filter. Moving is a licensing and support decision, and it is one-way. GoDaddy says "The organization can't move back to GoDaddy once it has moved away," that licenses bought through GoDaddy "won't transfer to Microsoft," and that after the move GoDaddy "can't provide support" (GoDaddy Help). If you do move and use Advanced Email Security, GoDaddy says to release any quarantined mail you want to keep and update your MX records first.

Next steps

• Look up your MX with the MX Lookup tool so you know which layer filters first.
• Sign in to the Defender portal with your Microsoft 365 admin account and apply the Standard or Strict preset.
• If you have Advanced Email Security, review its sensitivity and quarantine release settings.
• If you decide to put an MX-level filter in front of Microsoft 365, our Microsoft 365 setup page lists the exact connector steps for iBlockSpam, priced per domain rather than per mailbox.