SPF record for GoDaddy (Professional Email, Microsoft 365 from GoDaddy)

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

GoDaddy email only

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:secureserver.net -all

GoDaddy email and Google Workspace

Type: TXT · Host: @ · 4 of 10 DNS lookups Copy

v=spf1 include:secureserver.net include:_spf.google.com -all

GoDaddy email and Zendesk

Type: TXT · Host: @ · 4 of 10 DNS lookups Copy

v=spf1 include:secureserver.net include:mail.zendesk.com -all

How SPF applies to GoDaddy mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). GoDaddy sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• On 9 October 2026, secureserver.net nested include:spf.protection.outlook.com. Listing both spends an extra lookup and adds nothing.

How to add it

1. In your GoDaddy account, open the DNS records for your domain.
2. Look for an existing TXT record on @ that starts with v=spf1. GoDaddy says only one SPF record works on a domain at a time.
3. Edit that record to include include:secureserver.net, or add a TXT record with name @ and the value above.
4. If you have Microsoft 365 from GoDaddy with the Advanced Email Security add-on, use the SPF record shown in your Email & Office dashboard instead.
5. Save, then check the live record with the SPF Checker below.

DKIM and DMARC alignment

SPF only checks the envelope sender. Check your GoDaddy email product's settings for DKIM signing on your domain, then publish a DMARC record so receivers know what to do with mail that fails both checks.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). GoDaddy's include costs 3 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. GoDaddy's documentation uses -all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding include:spf.protection.outlook.com next to include:secureserver.net for Microsoft 365 from GoDaddy: it is already nested inside GoDaddy's include.