How to Set Up DKIM on GoDaddy (Microsoft 365 Email)
Setting up DKIM on GoDaddy takes three steps: create your DKIM keys, add two records to your GoDaddy DNS, then switch signing on. This guide covers the most common setup, where you use GoDaddy's Microsoft 365 email and manage your DNS at GoDaddy.
DKIM adds a signature to every email you send, so receiving servers can confirm the message genuinely came from your domain and wasn't forged. Without it, your domain is easier to spoof. The steps below get it working from start to finish.
Before you start: where your DKIM key comes from
GoDaddy is usually your DNS host, but the DKIM key itself is created by whatever service actually sends your email. This guide is for GoDaddy email that runs on Microsoft 365, with your domain's DNS managed at GoDaddy.
If you send through Google Workspace, your own hosting, or a marketing tool, your steps will differ, because the key is generated there instead. Not sure who handles your mail? Our MX lookup shows your provider in seconds.
You'll also need admin access to your Microsoft 365 account to create and switch on the keys.
Step 1: Create your DKIM keys in Microsoft 365
The keys are generated in the Microsoft 365 Defender portal, not in GoDaddy.
- Go to security.microsoft.com/dkimv2 and sign in with your Microsoft 365 email and password (your GoDaddy login won't work here).
- Under DomainKeys Identified Mail (DKIM), select your domain name itself, not the checkbox next to it. A panel opens on the right.
- Select Create DKIM keys. Microsoft generates two records, both as CNAMEs.
- Copy both records. You'll get a host and a value for each, pointing to a …onmicrosoft.com address. Keep them handy for the next step.
Step 2: Add the DKIM records in GoDaddy DNS
Now publish those two CNAME records in your GoDaddy DNS so the rest of the internet can find your keys.
- Sign in to your GoDaddy account, open your domain, and go to DNS (Manage DNS).
- Select Add New Record and choose CNAME for the type.
- For the first record, enter the host as selector1._domainkey and the value Microsoft gave you. Enter the host without your domain on the end. GoDaddy adds it for you.
- Add a second CNAME the same way for selector2._domainkey with its matching value.
- Save both records. DNS changes can take up to 48 hours to spread, though they're often live within an hour.
Step 3: Turn on DKIM signing
Adding the records isn't enough on its own. You have to switch signing on so Microsoft 365 starts signing your mail.
Go back to security.microsoft.com/dkimv2, select your domain, and turn the signing toggle to Enabled. If the toggle is greyed out or shows an error, the CNAME records usually haven't finished propagating yet. Wait a while and try again.
How to check DKIM is working
Once signing is on and the records have propagated, confirm it actually works.
Run your domain through our free DKIM checker to see whether a valid key is found. You can also send a test email to a Gmail address, open it, and use Show original to check that DKIM shows PASS.
Common problems
Most GoDaddy DKIM issues come down to a few causes.
- The signing toggle won't enable: the CNAME records haven't propagated, or a host or value was mistyped. Re-check both records and wait.
- Only the onmicrosoft.com domain appears in the Defender portal: your custom domain isn't fully set up in Microsoft 365 yet.
- The checker finds no key: confirm both CNAMEs are saved at GoDaddy with the exact values from Microsoft, and that signing is switched on.
- Duplicate or old records: remove any leftover DKIM records from a previous provider so they don't clash.
Check your domain now
Enter your domain to see your current email security status.
Frequently Asked Questions
Does GoDaddy set up DKIM automatically?
No. For Microsoft 365 email, you create the DKIM keys in the Microsoft 365 Defender portal, add the two CNAME records to your GoDaddy DNS yourself, and then switch signing on. GoDaddy hosts the records, but it doesn't generate or enable the key for you.
Why can't I turn on DKIM in Microsoft 365?
The most common reason is that the two CNAME records haven't finished propagating, so Microsoft can't verify them yet. Double-check the host and value of each record in GoDaddy DNS, then wait and try the toggle again. Propagation can take up to 48 hours, though it's usually much faster.
How long does DKIM take to work on GoDaddy?
After you save the CNAME records, DNS changes can take up to 48 hours to spread, but they often go live within an hour. Once the records resolve, you can switch on signing in the Defender portal and DKIM starts working straight away.
Do I still need SPF and DMARC?
Yes. DKIM is one of three records that work together. SPF lists who can send for your domain, and DMARC tells providers what to do with mail that fails. DKIM on its own helps, but all three together give your domain real protection from spoofing.
That's DKIM set up on GoDaddy for Microsoft 365 email: keys created in the Defender portal, two CNAME records added in GoDaddy DNS, and signing switched on. Confirm it with our DKIM checker once the records have propagated.
DKIM is one of three records that have to line up, across every tool that sends your email. If you'd rather not manage that yourself, readyDMARC sets up and monitors SPF, DKIM, and DMARC for you.
Related Articles
What Is DKIM? How Email Signing Works
Learn what DKIM is, how DomainKeys Identified Mail protects your business emails from tampering, and...
Read more →How to Set Up DKIM for Office 365 (Microsoft 365)
Set up DKIM for Office 365: create your DKIM keys in the Microsoft 365 Defender portal, add the two ...
Read more →How to Set Up DKIM for Google Workspace (Gmail)
Set up DKIM for Google Workspace (Gmail): generate the key in the Admin console, publish the google....
Read more →Misconfiguring this is easy, and costly
One wrong record can let attackers send email as your domain, or block your own legitimate mail once you turn on enforcement. Getting from a published record to real protection, without breaking delivery, is where most teams get stuck. Our specialists set up SPF, DKIM, and DMARC for you and roll it out safely, checking at every stage.