GoDaddy DKIM: Set Up CNAME or TXT Records Step by Step

By Umair Ali Sadaqat · Updated November 6, 2026 · Editorial policy

How to set up DKIM on GoDaddy DNS for Microsoft 365 or Google Workspace: which records to add (CNAME vs TXT), where to paste them, and how to test.

Short answer: In GoDaddy, open your domain's DNS page, choose Add New Record, and paste in the DKIM record your email provider gave you. Microsoft 365 uses two CNAME records (selector1._domainkey and selector2._domainkey). Google Workspace uses one TXT record (by default at google._domainkey). Enter only the prefix in the Name field, wait for DNS to update, then switch signing on in your email admin panel and test with an external message.

DKIM adds a cryptographic signature to every message you send. The receiving server looks up your public key in DNS and checks that the signature matches. GoDaddy is only where the record lives, so the exact values always come from your email provider. This page covers the GoDaddy side and the two most common providers.

Before you start: which record type do you need?

The record type is dictated by the provider, not by GoDaddy. You don't choose between CNAME and TXT; you add whichever one your provider hands you.

Provider	Record type	Host (Name)	Where the value comes from	Switch-on step
Microsoft 365	Two CNAME records	selector1._domainkey and selector2._domainkey	Your tenant's DKIM page in the Microsoft Defender portal	Enable signing after both records are published
Google Workspace	One TXT record	google._domainkey (default selector prefix)	Admin console, Gmail, Authenticate email, Generate New Record	Click Start Authentication after the record resolves
Other senders (newsletter or CRM tools)	CNAME or TXT, depends on the tool	Whatever the tool displays	The tool's domain authentication screen	Usually a Verify button

Why CNAME vs TXT? A TXT record holds the public key itself. A CNAME points to a key the provider hosts, which lets Microsoft rotate keys without you touching DNS again. That is why Microsoft publishes two selectors: so it can switch between them.

How to add a DKIM record in GoDaddy

GoDaddy's menu labels vary slightly between account layouts (older help pages say Edit DNS, Host and Add Record), so follow the closest match.

Sign in to your GoDaddy account and open the domain's settings, then the DNS page.
Select Add New Record.
Set Type to TXT or CNAME, matching your provider's instructions.
In Name (sometimes labeled Host), enter only the prefix, such as selector1._domainkey or google._domainkey. GoDaddy's help describes this field as the name without your domain.
In Value (or Points to for a CNAME), paste exactly what your provider shows. Don't add quotes or trailing spaces unless your provider says to.
Leave TTL at the default (GoDaddy's help lists 1 hour as the default) and select Save.
Repeat for the second CNAME if you're on Microsoft 365.

GoDaddy's own page for this is Add a TXT record.

Microsoft 365 on GoDaddy: two CNAME records

Microsoft's documentation says custom domains aren't DKIM-signed until you set it up, and that you publish two CNAME records per domain.

In the Microsoft Defender portal, open the DKIM settings under Email authentication and select your custom domain.
Copy both CNAME entries Microsoft shows. The targets follow a pattern built from your domain with dots turned into dashes plus your initial onmicrosoft.com domain, but formats can differ by tenant, so copy rather than construct.
Add both as CNAME records in GoDaddy (steps above), using selector1._domainkey and selector2._domainkey as the names.
Wait for DNS to update, return to the DKIM page, and enable signing for the domain. If Microsoft says the records can't be found, see the troubleshooting list below.

You can also enable signing with PowerShell (Set-DkimSigningConfig), which Microsoft documents on its DKIM setup page.

Google Workspace on GoDaddy: one TXT record

In the Google Admin console, go to Gmail, then Authenticate email, pick your domain, and select Generate New Record.
Choose a 2048-bit key if your DNS host supports it. Keep the default selector prefix (google) unless you have a reason to change it.
Copy the host name and the TXT value (it begins with v=DKIM1). Don't click Start Authentication yet.
Add the TXT record in GoDaddy with Name google._domainkey and the full value.
Wait, then go back to Authenticate email and click Start authentication. Google says it can take up to 48 hours after adding the key.

Two notes from Google's DKIM setup help: a very new Gmail setup may not offer a key for 24 to 72 hours, and a 2048-bit key may not fit in a single 255-character string at some DNS hosts. If that happens, split the value into quoted strings where the host allows it, or use a 1024-bit key.

How to check that DKIM is working

Looking at DNS alone tells you the record exists. A real message tells you it's signing.

Look up the record. Use any DKIM lookup tool, or a DNS query for selector1._domainkey.yourdomain.com (CNAME) or google._domainkey.yourdomain.com (TXT).
Check the admin panel. Google shows "Authenticating email with DKIM" once active; Microsoft shows signing as enabled for the domain.
Send to an outside mailbox. Microsoft notes that mail between users in the same domain can skip the signature, so send to a different provider, such as a personal Gmail address.
Read the headers. Open the original message source and find the DKIM-Signature line with d=yourdomain.com, and an Authentication-Results line showing dkim=pass.

Troubleshooting checklist

[ ] The Name has only the prefix, not the full domain (no yourdomain.com.yourdomain.com).
[ ] The value was pasted whole, with no line breaks or missing characters.
[ ] Both Microsoft CNAMEs are present, not just one.
[ ] There's only one DKIM TXT record at each selector.
[ ] You waited at least an hour, and up to 48 hours before re-generating keys.
[ ] If Microsoft keeps failing, delete and re-copy the targets from your tenant's DKIM page.
[ ] If an outbound gateway adds footers after signing, test without it; changing the body after signing breaks DKIM.

What to do after DKIM

DKIM is one third of the picture. Publish an SPF record and a DMARC policy too, so receivers know what to do when a check fails. Our SPF, DKIM and DMARC guide walks through all three.

If your domain sits at GoDaddy but you're weighing where to build the site itself, see the GoDaddy alternatives or the GoDaddy website builder pricing breakdown. DNS records like the ones above stay in GoDaddy whichever builder you pick. We.Inc's free plan lets you publish up to three sites from ready-made templates; the AI builder that drafts a site from a prompt starts on the Starter plan at $20 a month. You can sign up here.

Frequently asked questions

Does GoDaddy generate a DKIM key for me?

No. GoDaddy DNS only stores the record. The key comes from whoever sends your mail: Microsoft 365, Google Workspace, or another email or marketing service. You copy the host name and value they give you into GoDaddy's DNS page.

Should I enter the full domain in the Name field?

Usually no. GoDaddy's help pages describe the Name field as the host or prefix without your domain name, so you would enter something like selector1._domainkey or google._domainkey. Some forms and older layouts label this field Host. Save the record, then look it up publicly to confirm it resolves under your domain and not twice (yourdomain.com.yourdomain.com).

How long does GoDaddy DKIM take to start working?

GoDaddy says DNS changes usually take effect within an hour but can take up to 48 hours globally. Google's help says DKIM can take up to 48 hours to start working after you add the key. Microsoft will only let you switch signing on once it can see both CNAME records.

My 2048-bit Google key won't fit in the TXT value. What now?

Google's docs note that a 2048-bit key may not fit in a single 255-character string at some DNS hosts. Options are to split the value into quoted strings if your host allows it, or to generate a 1024-bit key instead. GoDaddy's TXT help page lists a maximum of 1024 characters per record, so paste the whole value exactly as Google shows it and test the result.

Why does Microsoft 365 say my DKIM CNAME records are missing when they're in GoDaddy?

The usual causes are a typo in the host or target, a Name field that has the domain appended twice, or DNS that hasn't propagated yet. Copy the two CNAME values straight from your tenant's DKIM page rather than building them by hand, since Microsoft's target format can differ between tenants.

Do I need DKIM if I already have SPF?

They do different jobs. SPF checks which servers may send for your domain; DKIM signs the message itself so tampering can be detected. DMARC builds on both. Our guide to [SPF, DKIM and DMARC](/guides/spf-dkim-dmarc) explains how they fit together.

Alternatives mentioned in this article

GoDaddy alternatives

Related guides and tools

DNS lookup

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.