Defaults.Exposed

Defaults.Exposed › Setup walkthroughs › DMARC › GoDaddy

How to set up DMARC on GoDaddy

The host name is _dmarc, with the underscore, and nothing after it. Leaving off the _ character, or typing the full domain after it, puts the record where DMARC (Domain-based Message Authentication, Reporting and Conformance) is never looked up. That one field accounts for most of the DMARC records that exist but are never found.

What goes in the DMARC record

v=DMARC1; p=none; rua=mailto:you@yourdomain.com

v=DMARC1 names the version and has to come first. p=none is the policy, and it instructs receivers to change nothing. rua=mailto: is the address aggregate reports are sent to.

At p=none nothing is blocked, and any enforcement at all depends on SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) aligning with the From domain first. On day one the record gives you visibility, which is what makes the later steps safe.

Check that GoDaddy answers DNS for the domain

In the GoDaddy account, open the domain and read the Nameservers section. If it shows GoDaddy’s own nameservers, GoDaddy answers DNS (Domain Name System) for this domain and the record belongs here. If it shows another company’s nameservers, such as a web host, a CDN (Content Delivery Network) or the email provider, the record has to be added at that provider instead, because a record added at GoDaddy will have no effect.

GoDaddy is the domain registrar and, when its own nameservers are in use, the DNS host for the domain. It stores the DMARC TXT (Text) record exactly as you type it into the Name and Value fields and answers lookups for it once the nameservers point at GoDaddy. It does not validate or apply the record, and it does not compose the DMARC string, choose the policy or supply a reporting mailbox: you provide all three.

Add the record in the GoDaddy console

  1. Sign in to GoDaddy and open the domain from the account’s domain list.
  2. Open the domain’s DNS settings, labelled DNS, Manage DNS, or DNS / Records depending on the account.
  3. Select Add or Add New Record to start a new DNS entry.
  4. Set the record type field to TXT.
  5. In the Name field or Host field, enter exactly _dmarc, with the leading _ character and nothing appended after it.
  6. In the Value field, paste the DMARC string plain, with no surrounding quotation marks.
  7. Leave the TTL (Time to Live) field at its default setting.
  8. Save the record to publish it in GoDaddy DNS.

In the Name or Host field, type only _dmarc, because GoDaddy appends the domain automatically and typing _dmarc.yourdomain.com puts the record at the wrong host name. In the Value or Content field, paste the full string starting v=DMARC1; with your own reporting mailbox after rua=mailto:.

Traps in the GoDaddy form

Alignment, which is what actually decides the outcome

DMARC asks more than whether SPF or DKIM passed: it asks whether one of them passed for a domain that matches the domain in the visible From address. That second half is alignment, and it is where most surprises live.

Take a newsletter tool that sends on your behalf. SPF passes, because the envelope sender is the tool’s own domain and that domain’s record authorises its servers. DMARC still fails, because the From address your reader sees says your domain and the SPF pass belongs to theirs. The fix is getting the tool to sign with a DKIM key published on your domain, so the signature aligns; another SPF include will not change the result.

The same mechanism explains why forwarding is not fatal. A forwarded message fails SPF, because the forwarding server was never on your list, but a DKIM signature travels with the message and still verifies. DMARC passes if either mechanism passes with alignment, so DKIM covers the case SPF cannot.

What the reports tell you, and how often

Reports come from the receiving mail providers. Every large receiver that handles mail claiming to be from your domain sends an aggregate report to your rua= address, usually once a day.

Each one is a compressed XML file covering a single day, listing the sending sources it saw with a message count and the authentication results for each. A week of them from a small domain is a complete inventory of everything sending in your name, which is information almost nobody has before they publish this record.

What you are reading for is a short list: sources you recognise that are failing. A campaign tool with no DKIM key, an invoicing platform with no SPF include, a shop plugin relaying through the web host. Each is fixed at that service, not in this record.

Raw XML gets tedious after the first week, so most people point rua= at a hosted DMARC reporting service or run the files through a parser. Either is fine. What matters is that somebody looks, because an unread reporting address is the same as no reporting address, and the census suggests a great many domains have one of those.

Wait, then read the result

A DNS change at GoDaddy can take from minutes up to a couple of hours to be visible everywhere. The saved record appears back in the same DNS settings screen, listed as a TXT record at _dmarc. Reopen the DNS settings screen after saving and confirm the TXT record at _dmarc is listed with the value typed, with no duplicate entry at the same host name.

How the scan grades this record: the DMARC policy check, with its pass and fail rules and how many domains pass it.

For context on where most domains sit: 249,025,625 domains (74.9%) in the October 2026 census publish no DMARC record at all, and of those that sit at p=none, 35,049,364, or 80.17%, have no rua= address either.

Once the reports show your legitimate senders aligning, move to p=quarantine and then p=reject. Receivers act on the record only at p=quarantine or p=reject.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.