Microsoft 365 bought through GoDaddy

Not sure how you bought it? Check your Microsoft 365 sign-in page or invoices. If you pay GoDaddy for “Microsoft 365 from GoDaddy” or “Email Essentials/Plus”, this guide is for you. If you pay Microsoft directly, use the standard Microsoft 365 + GoDaddy DNS guide.

How it’s different

• GoDaddy adds your DNS records automatically when it sets up your mailboxes. Don’t delete records you don’t recognise until you’ve checked what they do.
• Your Microsoft tenant has a GoDaddy-style name, usually starting NETORG (for example NETORG1234567.onmicrosoft.com). It appears in your DKIM records.
• Some admin pages are limited. You manage most things in GoDaddy’s email dashboard rather than Microsoft’s admin centre.

1. Check your SPF covers Microsoft 365

Run the SPF checker. In the list of services, you should see Microsoft 365 (spf.protection.outlook.com), either directly or inside one of GoDaddy’s includes. If it’s there, leave the record alone.

If Microsoft 365 is missing, edit the existing TXT record that starts v=spf1 in GoDaddy DNS and add include:spf.protection.outlook.com before the -all or ~all at the end. Keep one SPF record only.

2. Switch on DKIM signing

Microsoft 365 signs your email with your own domain only once DKIM is switched on. Without it, forwarded email and mailing lists can fail, especially after you turn on DMARC protection.

1. Sign in at security.microsoft.com with your GoDaddy Microsoft 365 admin account and go to Email & collaboration › Policies & rules › Threat policies › Email authentication settings, then the DKIM tab.
2. Select your domain. Microsoft shows two CNAME records, for selector1._domainkey and selector2._domainkey, pointing to addresses that include your NETORG tenant name. Copy both exactly.
3. In GoDaddy, open your domain’s DNS page and add both as CNAME records. GoDaddy adds your domain automatically, so the Name is just selector1._domainkey and selector2._domainkey.
4. Wait an hour or two, then return to the DKIM tab and switch signing on.

If you can’t open that page, or the DKIM tab is missing, your GoDaddy plan may not give you that access. Contact GoDaddy support and ask them to enable DKIM for your domain. Some businesses choose to move their Microsoft 365 subscription from GoDaddy to Microsoft directly (often called “defederating”) for full admin access; that’s a bigger project, best done with an IT partner.

3. Add spoofing protection (DMARC)

GoDaddy doesn’t always add DMARC. If the DMARC checker shows none, add this in GoDaddy DNS:

Type	Name	Value
TXT	_dmarc	v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Replace the address with a mailbox you read. Once DKIM is on and reports show your email passing, follow the none-to-reject plan.

4. Check your work

Run the email health check. You’re aiming for a pass on mail servers, SPF and DKIM (key found: selector1), with DMARC on monitor-only for now.