# DKIM record for GoDaddy (Professional Email, Microsoft 365 from GoDaddy) URL: https://iblockspam.com/dkim/godaddy Last updated: 2026-10-09 Record type: CNAME Selectors: secureserver1, secureserver2 Key managed by: Provider (CNAME delegation) GoDaddy Professional Email signs with two CNAME records, `secureserver1._domainkey` and `secureserver2._domainkey`, whose targets you copy from the Email & Office Dashboard. Microsoft 365 bought from GoDaddy is different: you create the keys in Microsoft's Defender portal with your Microsoft 365 sign-in and publish Microsoft's `selector1` and `selector2` CNAMEs. ## DNS records - Professional Email, selector 1 (CNAME, host secureserver1._domainkey): `` GoDaddy's help gives a TTL of 1 hour for both records. - Professional Email, selector 2 (CNAME, host secureserver2._domainkey): `` - Microsoft 365 from GoDaddy, selector 1 (CNAME, host selector1._domainkey): `` The format is the same as for any Microsoft 365 tenant; see our [Microsoft 365 DKIM page](https://iblockspam.com/dkim/microsoft-365). - Microsoft 365 from GoDaddy, selector 2 (CNAME, host selector2._domainkey): `` ## Set it up and turn on signing - **Professional Email:** in the Email & Office Dashboard, open **Users**, choose **Manage** next to an account and select **Set mail destination**, or use the **Help me fix this** banner, to see the two DKIM CNAME targets. - Add both CNAMEs in GoDaddy DNS (or wherever your DNS is hosted). GoDaddy recommends adding SPF and DKIM before DMARC. - **Microsoft 365 from GoDaddy:** sign in to Microsoft's Defender portal with your Microsoft 365 email address and password; GoDaddy notes your GoDaddy username and password won't work there, and you need admin permissions. - Under DomainKeys Identified Mail (DKIM), select the domain, choose **Create DKIM keys**, and copy the two CNAME values into GoDaddy DNS. - Turn on **Sign messages for this domain with DKIM signatures**. GoDaddy says to allow up to 48 hours, and to repeat the steps for every domain beyond the onmicrosoft.com one Microsoft sets up for you. ## DMARC alignment Both setups sign with your own domain once the CNAMEs resolve, so DMARC can pass on DKIM even when SPF fails after forwarding. With Microsoft 365 from GoDaddy, Microsoft only signs the initial `onmicrosoft.com` domain on its own; your custom domain is unsigned until you complete the steps. If you add GoDaddy's Advanced Email Security filtering, its help describes an extra signing key with a TXT record whose host starts with `selector`, created after a GoDaddy Guide opens the Domains section for you. ## Key length and rotation With CNAME records the private keys stay with GoDaddy (Professional Email) or Microsoft (Microsoft 365), so a key change happens behind the targets without DNS edits. For Microsoft 365 from GoDaddy, the key size and rotation work as for any tenant: 1024 or 2048 bits, and a manual rotation that takes four days to switch selectors. ## Common mistakes - **Using GoDaddy credentials in Microsoft's portal.** Microsoft 365 from GoDaddy needs the Microsoft 365 admin account's email address and password. - **Setting up only the first domain.** Each extra domain on the Microsoft 365 plan needs its own two CNAMEs and its own switch. - **Publishing Microsoft's CNAMEs for Professional Email.** Professional Email uses the `secureserver` selectors; the `selector1`/`selector2` pair belongs to Microsoft 365. **Q: Does GoDaddy add DKIM to Microsoft 365 automatically?** No. GoDaddy's help has you create the keys in Microsoft's Defender portal with your Microsoft 365 admin sign-in, add the two CNAMEs in GoDaddy DNS and turn signing on. Only the onmicrosoft.com domain is signed without any setup. **Q: Where do I find the DKIM targets for GoDaddy Professional Email?** In the Email & Office Dashboard. Open Users, choose Manage next to an account and select Set mail destination, or follow the Help me fix this banner. There are two targets, for `secureserver1._domainkey` and `secureserver2._domainkey`. **Q: Why does GoDaddy Advanced Email Security need another DKIM record?** That add-on can sign outgoing mail itself. GoDaddy's help has a GoDaddy Guide give you access to its Domains section, where you create a signing key and publish one more TXT record whose host starts with `selector`, then verify it. Sources: - GoDaddy Help: Enable and add DKIM to my domain for Microsoft 365: https://www.godaddy.com/en/help/enable-and-add-dkim-to-my-domain-for-microsoft-365-41748 - GoDaddy Help: Add SPF, DKIM and DMARC to my domain for Professional Email: https://www.godaddy.com/en/help/add-spf-dkim-and-dmarc-to-my-domain-for-professional-email-powered-by-titan-42437 --- Source: iBlockSpam, https://iblockspam.com/dkim/godaddy (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt