DKIM record for GoDaddy (Professional Email, Microsoft 365 from GoDaddy)

The DNS records

GoDaddy shows the targets in your account rather than in its help article. Its help says there are two, and each one includes dkim.

Professional Email, selector 1

Type: CNAME · Host: secureserver1._domainkey Copy

<target 1 from the Email & Office Dashboard>

GoDaddy's help gives a TTL of 1 hour for both records.

Professional Email, selector 2

Type: CNAME · Host: secureserver2._domainkey Copy

<target 2 from the Email & Office Dashboard>

Microsoft 365 from GoDaddy, selector 1

Type: CNAME · Host: selector1._domainkey Copy

<Selector1CNAME value from the Microsoft Defender portal>

The format is the same as for any Microsoft 365 tenant; see our Microsoft 365 DKIM page.

Microsoft 365 from GoDaddy, selector 2

Type: CNAME · Host: selector2._domainkey Copy

<Selector2CNAME value from the Microsoft Defender portal>

Set it up and turn on signing

1. Professional Email: in the Email & Office Dashboard, open Users, choose Manage next to an account and select Set mail destination, or use the Help me fix this banner, to see the two DKIM CNAME targets.
2. Add both CNAMEs in GoDaddy DNS (or wherever your DNS is hosted). GoDaddy recommends adding SPF and DKIM before DMARC.
3. Microsoft 365 from GoDaddy: sign in to Microsoft's Defender portal with your Microsoft 365 email address and password; GoDaddy notes your GoDaddy username and password won't work there, and you need admin permissions.
4. Under DomainKeys Identified Mail (DKIM), select the domain, choose Create DKIM keys, and copy the two CNAME values into GoDaddy DNS.
5. Turn on Sign messages for this domain with DKIM signatures. GoDaddy says to allow up to 48 hours, and to repeat the steps for every domain beyond the onmicrosoft.com one Microsoft sets up for you.

DMARC alignment

Both setups sign with your own domain once the CNAMEs resolve, so DMARC can pass on DKIM even when SPF fails after forwarding. With Microsoft 365 from GoDaddy, Microsoft only signs the initial onmicrosoft.com domain on its own; your custom domain is unsigned until you complete the steps. If you add GoDaddy's Advanced Email Security filtering, its help describes an extra signing key with a TXT record whose host starts with selector, created after a GoDaddy Guide opens the Domains section for you.

Key length and rotation

With CNAME records the private keys stay with GoDaddy (Professional Email) or Microsoft (Microsoft 365), so a key change happens behind the targets without DNS edits. For Microsoft 365 from GoDaddy, the key size and rotation work as for any tenant: 1024 or 2048 bits, and a manual rotation that takes four days to switch selectors.

Common mistakes

• Using GoDaddy credentials in Microsoft's portal. Microsoft 365 from GoDaddy needs the Microsoft 365 admin account's email address and password.
• Setting up only the first domain. Each extra domain on the Microsoft 365 plan needs its own two CNAMEs and its own switch.
• Publishing Microsoft's CNAMEs for Professional Email. Professional Email uses the secureserver selectors; the selector1/selector2 pair belongs to Microsoft 365.