How to add or edit an SPF record in GoDaddy (step-by-step)

GoDaddy is one of the largest domain registrars in the world. Millions of small businesses host DNS there. Many already have an SPF record through a GoDaddy email product, and many others need to add or repair one manually.

SPF (Sender Policy Framework) tells receiving mail servers which IP addresses are allowed to send email for your domain. Without it, anyone can send email pretending to be you. Gmail, Microsoft, and Yahoo all check SPF when deciding whether to deliver or spam your messages.

Adding or editing an SPF record in GoDaddy takes about 10 minutes. The main risk is not the interface; it is creating a second SPF record instead of updating the one that already exists.

This guide shows you how to set up SPF on GoDaddy, step by step, from building the record to verifying it works.

Before you start

You’ll need access to your GoDaddy account with permission to edit DNS records. You also need to confirm that DNS is actually managed at GoDaddy. GoDaddy’s SPF help says the domain must use GoDaddy nameservers to add SPF in the GoDaddy account. If your nameservers point to Cloudflare, Wix, Squarespace, Route 53, or another provider, edit SPF there instead.

You also need to know which email services send mail as your domain.

Think about it: do you use Google Workspace? Microsoft 365? A marketing platform like Mailchimp or HubSpot? A transactional email service like SendGrid? Each service needs to be included in your SPF record.

If your domain, DNS, and email are all in the same GoDaddy account, GoDaddy says it may add SPF for you. You should still check the DNS record before changing anything.

If you’re not sure what services send email as your domain, that’s exactly what DMARC monitoring solves. We’ll cover that at the end.

Step 1: build your SPF record

Before touching GoDaddy, you need to know what to put in the record.

Go to our SPF record generator. Select the email services you use, and the tool builds a valid SPF record for you. It also counts DNS lookups in real-time, which matters because SPF has a hard limit of 10 lookups before it breaks.

For a basic setup with Google Workspace, the generator outputs something like:

v=spf1 include:_spf.google.com -all

If you use Microsoft 365 directly from Microsoft:

v=spf1 include:spf.protection.outlook.com -all

If you use Microsoft 365 from GoDaddy, Professional Email, Linux Hosting, Gen 4 VPS or Dedicated Hosting, or Media Temple Mail, GoDaddy’s documented SPF value is:

v=spf1 include:secureserver.net -all

If you have Microsoft 365 from GoDaddy with the Advanced Email Security add-on, GoDaddy says to get the SPF value from the Email & Office Dashboard.

If you use both (which is unusual, but happens during migrations):

v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

Copy your generated or provider-supplied record. You’ll paste it into GoDaddy in Step 4.

Step 2: log into GoDaddy

Go to GoDaddy’s Domain Portfolio and sign in.

GoDaddy’s current SPF instructions use this path: select an individual domain to open the Domain Settings page, then select DNS to view records.

You may also get there through My Products: click your profile icon, select My Products, find your domain under Domains, and choose DNS next to the domain name.

Both paths land you at the same DNS management screen.

Step 3: check for existing SPF records

This step is important. You can only have one SPF record per domain. If you already have an SPF record and add another, both become invalid. Receiving servers see the conflict and return an error.

In your DNS records list, look for any TXT record that starts with v=spf1. It might look like this:

Type: TXT
Name: @
Value: v=spf1 include:some-service.com -all

If you find one, edit the existing record instead of creating a second one. For example, if you have v=spf1 include:_spf.google.com -all and need to add SendGrid, edit it to v=spf1 include:_spf.google.com include:sendgrid.net -all.

If you don’t have an existing SPF record, proceed to Step 4.

Step 4: add or edit the SPF TXT record

If you found an existing SPF record, edit it. If not, select Add New Record and choose TXT from the Type menu. Fill in these fields:

Field	Value
Type	TXT
Name / Host	@
Value / TXT Value	Your SPF record (from Step 1)
TTL	Leave as default

The Name field should be @ (the at symbol). In GoDaddy’s DNS, @ means the root of your domain. Your SPF record will apply to yourdomain.com.

For the Value field, paste your entire SPF record exactly as generated. Do not add quotes around it. GoDaddy handles quoting internally.

GoDaddy’s SPF help says the Value field must be ASCII and can be up to 512 characters. If your SPF record is approaching that length or using many include: mechanisms, you should simplify it before saving because SPF also has a DNS lookup limit.

Example of what you’re entering:

Type:  TXT
Name:  @
Value: v=spf1 include:_spf.google.com include:sendgrid.net -all

Step 5: save the record

Click Save.

If your domain has GoDaddy Domain Protection enabled, GoDaddy may require identity verification before the DNS change is saved. After saving, you should see one TXT record at @ whose value starts with v=spf1.

Step 6: verify it works

GoDaddy says most DNS updates take effect within an hour but can take up to 48 hours globally.

To verify your SPF record is live, go to DMARCTrust’s domain checker, enter your domain name, and look at the SPF section.

You should see your record displayed. The checker also shows you how many DNS lookups your record requires. If you’re at 10 or above, you have a problem that needs fixing.

GoDaddy-specific pitfalls

GoDaddy’s DNS interface has a few details that trip people up.

SPF value length. GoDaddy’s SPF help lists a 512-character maximum for the SPF value and ASCII-only content. Long SPF records are often a sign that too many services are included. They are also more likely to hit SPF’s DNS lookup limit.

The @ symbol confusion. In GoDaddy, @ means your root domain. Don’t enter your full domain name in the Name field. If your domain is example.com, entering example.com creates a record for example.com.example.com. That’s wrong, and it’s a mistake we see constantly.

DNS hosted somewhere else. If your domain is registered at GoDaddy but uses another provider’s nameservers, GoDaddy’s DNS records are not authoritative. Add or edit SPF at the DNS provider your nameservers point to.

Propagation delays. GoDaddy says DNS updates usually take effect within an hour, but global propagation can take up to 48 hours. You can verify propagation using our domain checker or command-line tools like dig or nslookup.

Common SPF mistakes

Beyond GoDaddy-specific issues, here’s what we see go wrong most often.

Multiple SPF records. You can only have one SPF record per domain. Two v=spf1 TXT records invalidates both. Check your DNS for duplicates before adding anything new. For more on this, see our SPF documentation.

Exceeding 10 DNS lookups. Every include: in your SPF record triggers DNS lookups. Go over 10 and SPF fails for all your email with a PermError. Our SPF generator shows lookup counts as you build your record.

Forgetting services. Your company probably sends email from more places than you realize. Marketing tools, CRM systems, helpdesk software, billing platforms, your IT ticketing system. Each one that sends as your domain needs to be in your SPF record. Miss one, and those emails fail.

Using a random SPF value. If you use GoDaddy email products, use GoDaddy’s documented value or the value shown in the Email & Office Dashboard. If you use third-party providers, use their SPF includes and merge them into one record.

What about DMARC?

SPF alone isn’t enough. SPF tells receivers which servers are allowed to send your email, but it doesn’t tell them what to do when authentication fails. That’s what DMARC does.

DMARC adds a policy layer on top of SPF and DKIM. It tells receivers whether to deliver, quarantine, or reject messages that fail authentication. It also sends you reports about who’s sending email as your domain.

If you’re setting up SPF, you should set up DMARC too.

GoDaddy now automatically adds DMARC for some newer domains, so check for an existing _dmarc record before adding anything. The full walkthrough is in the GoDaddy DMARC setup guide.

v=DMARC1; p=none; rua=mailto:[email protected];

If there is no DMARC record yet, the independent setup is a TXT record named _dmarc with a value like the example above.

You get your unique reporting address when you sign up for DMARCTrust.

Alignment: why SPF isn’t always enough

Here’s something that trips people up. SPF can pass, but DMARC can still fail.

SPF checks the envelope sender (the Return-Path). DMARC checks whether that domain aligns with the From header. If they’re different (common with third-party senders), SPF passes but doesn’t help your DMARC result.

This is called SPF alignment. It’s why you need both SPF and DKIM properly configured. And it’s why monitoring matters.

Why monitoring matters

SPF is only the allowlist. It says which mail servers may send for your domain, but it does not tell you which services are actually sending, which ones are failing, or whether SPF is aligned for DMARC.

That is where DMARC monitoring helps. Aggregate reports show real traffic: source IPs, sending organizations, SPF pass/fail results, DKIM results, and whether either mechanism aligned with the visible From: domain.

DMARCTrust parses those reports automatically. You see which senders are covered by SPF, which ones need DKIM instead, and which GoDaddy TXT record changes are safe before moving DMARC toward enforcement.

Frequently asked questions

How do I add an SPF record in GoDaddy?

In GoDaddy DNS management, check whether a TXT record beginning with v=spf1 already exists. If it exists, edit it. If not, select Add New Record, choose TXT, enter @ in the Name field, paste your SPF value (for example, v=spf1 include:_spf.google.com -all), keep the default TTL, and save. Verify the record propagated using a DNS or DMARC checker.

Does GoDaddy have an SPF record by default?

Sometimes. GoDaddy says that if your domain, DNS, and email are in the same GoDaddy account, they add the SPF record for you. Their broader email-authentication help also says SPF is automatically added for Professional Email or Professional Email powered by Titan. Always check DNS before adding another v=spf1 TXT record.

What is the SPF record value for GoDaddy email?

If you use Microsoft 365 from GoDaddy, Professional Email, Linux Hosting, Gen 4 VPS or Dedicated Hosting, or Media Temple Mail, GoDaddy documents v=spf1 include:secureserver.net -all. If you use Microsoft 365 from GoDaddy with Advanced Email Security, check the Email & Office Dashboard for the exact SPF value. Combine third-party senders into the same record and keep total DNS lookups under 10.

Can I have two SPF records on a GoDaddy domain?

No. A domain can have only one SPF record. Two v=spf1 TXT records invalidate each other. Edit the existing record to add new senders rather than creating a second one.

How long does GoDaddy take to publish an SPF record?

GoDaddy says most DNS updates take effect within an hour but can take up to 48 hours globally.

The path to enforcement

Once SPF and DMARC are configured and you’re monitoring, here’s what happens next.

First couple of weeks: Review your DMARC reports in DMARCTrust. Identify every service that sends email as your domain. Make sure they’re all in your SPF record. You’ll probably find a few surprises.

Next few weeks: Fix alignment issues. Some services need DKIM configured with your domain to pass DMARC. Our enforcement playbook walks through this systematically.

Around month two: Move your DMARC policy from p=none to p=quarantine with a low percentage (start with 10%). This tests enforcement on a subset of traffic without risking all your email.

Month three and beyond: Gradually increase enforcement until you reach p=reject. That’s the goal. Attackers can’t spoof your domain anymore, and you’ve got the monitoring to prove your legitimate email still flows.

Check your domain now

Enter your domain in our free checker. You’ll see whether your SPF record is configured correctly, how many DNS lookups it uses, and whether you have DMARC set up.

For SPF, the important checks are concrete: one root-domain TXT record beginning with v=spf1, no duplicate SPF records, fewer than 10 DNS lookups, and every legitimate sender represented by the right include:, ip4:, or ip6: mechanism.

GoDaddy gives you the DNS editor. DMARCTrust shows whether the SPF record actually covers the mail your domain sends.

Additional resources

For more details on GoDaddy’s DNS management, see their official documentation:

• Manage DNS records - GoDaddy’s guide to adding and editing DNS records
• Add a TXT record - Specific instructions for TXT records