# How to add a DKIM record in GoDaddy—and verify it is signing > Add provider-issued DKIM TXT or CNAME records to GoDaddy DNS, avoid duplicated domain names and record conflicts, enable signing, verify the selector, and confirm DKIM alignment from a real message. - **Category:** Deliverability - **Published:** August 4, 2026 - **Reading time:** 18 min read - **Author:** Maya Chen, Email infrastructure - **Canonical page:** [https://emailbump.com/blog/godaddy-dkim-setup](https://emailbump.com/blog/godaddy-dkim-setup) To add DKIM in GoDaddy, first generate or copy the DKIM record from the service that actually sends your email. Then open the domain's DNS page in GoDaddy, add the exact TXT or CNAME type the sender supplied, enter only the selector host in GoDaddy's Name field, paste the supplied value, save, verify the public DNS answer, and enable signing at the sender if it requires a second step. GoDaddy often hosts DNS without sending the mail. Google Workspace, Microsoft 365, Email Bump, a help desk, a CRM, and a transactional provider each generate their own selectors and key material. There is no universal “GoDaddy DKIM value” for third-party email, and copying somebody else's public key cannot make your service hold the matching private key. > **Generate at the sender; publish at the DNS host** > > The sending service creates or delegates the DKIM key and tells you the record type, name, and value. GoDaddy publishes that record only when the domain uses GoDaddy nameservers. If DNS is hosted elsewhere, make the change there even if GoDaddy is the registrar. ## Identify the two companies involved ### DKIM ownership map ```text ROLE EXAMPLE RESPONSIBILITY Domain registrar GoDaddy Registration and nameserver delegation DNS host GoDaddy / Cloudflare / AWS Publish selector record publicly Email sender Email Bump / Google / CRM Hold private key and sign messages Mailbox host Google / Microsoft / other Receive mail for your own users DMARC monitor Internal or third party Aggregate alignment evidence One company can fill several roles, but do not assume it does. ``` Check the domain's authoritative nameservers before editing. If they point to a different DNS service, a record saved in GoDaddy's inactive zone will not appear publicly. Also confirm the exact From domain and sending service. Adding a key for example.com does not automatically configure a separate subdomain with its own DNS and signing setup. ## Understand the selector record ### DKIM DNS name ```text selector._domainkey.example.com | | | | | +-- signing domain | +---------------- fixed DKIM label +--------------------------- provider-chosen selector A message identifies the lookup in its DKIM-Signature: DKIM-Signature: v=1; d=example.com; s=eb2026; ... Receiver query: eb2026._domainkey.example.com ``` The selector lets a domain publish several keys at once. Different services should normally use different selectors, and key rotation can publish a new selector before the old one is retired. The selector is not secret. The private signing key must remain with the sender; DNS exposes only public verification material or a delegation target. ## TXT vs CNAME DKIM records ### Two normal provider patterns ```text TXT RECORD Name: eb2026._domainkey Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqh... CNAME DELEGATION Name: eb2026._domainkey Value: eb2026.example.com.dkim.provider.example Use exactly the type the sender supplies. A TXT public key is not a CNAME target. A CNAME target should not be pasted into a TXT record. ``` A TXT pattern publishes the public key directly in your zone. A CNAME pattern delegates that selector name to a provider-controlled hostname, allowing the provider to manage the target key. Neither is inherently evidence that messages are being signed; verify the DNS answer and then inspect a real message. ## Step 1: copy the provider-issued DKIM record - Open the sending service's domain, authentication, or DKIM settings—not GoDaddy's generic email screen unless GoDaddy supplies the mailbox service. - Copy the record type, full host/name, value/target, selector, and any verification or enable-signing step. - Keep capitalization and punctuation as supplied, but do not include presentation quotes unless the provider explicitly says they are part of the value. - Do not generate a new unrelated key when the service already owns the private key for a provided record. - Record which project, stream, domain, selector, and owner the key serves so it can be rotated or removed safely later. ## Step 2: confirm GoDaddy is authoritative ### Check nameservers ```bash dig NS example.com +short # If the authoritative nameservers belong to GoDaddy, edit GoDaddy DNS. # If they belong to another DNS provider, use that provider's zone editor. # Registrar and authoritative DNS host are not necessarily the same company. ``` ## Step 3: add the record in GoDaddy - Sign in to GoDaddy Domain Portfolio and select the domain. - Select DNS to view the active DNS records. - Choose Add New Record, then select TXT or CNAME exactly as the email sender instructed. - In Name, enter the provider's host prefix without the base domain when GoDaddy's form appends the zone—for example eb2026._domainkey rather than eb2026._domainkey.example.com. - In Value, paste the complete TXT public-key value or CNAME target supplied by the sender. - Use the provider's requested TTL or GoDaddy's default when no specific value is required, then save. - If Domain Protection prompts for identity verification, complete it and confirm the record appears in the zone list. > **Watch for a duplicated domain name** > > Many DNS forms append the zone automatically. Entering eb2026._domainkey.example.com into a Name field expecting only a prefix can create eb2026._domainkey.example.com.example.com. Check the fully qualified record GoDaddy shows after saving and query that exact selector publicly. ## GoDaddy Professional Email is a special case If GoDaddy Professional Email is the actual sending service, follow its Email & Office Dashboard instructions. GoDaddy's current documentation says that product can provide two DKIM CNAME records, commonly named secureserver1._domainkey and secureserver2._domainkey, with account-specific targets. Those names are not a generic recipe for Google Workspace, Microsoft 365, Email Bump, or another sender. If DNS and Professional Email are in the same GoDaddy account, some records may be automated. Inspect the current dashboard rather than adding duplicates from an article. For a third-party provider, use the third party's selector and value even though the DNS editor is GoDaddy. ## Step 4: verify the public DNS answer ### Query TXT and CNAME patterns ```bash # Direct TXT public key dig TXT eb2026._domainkey.example.com +short # CNAME delegation dig CNAME eb2026._domainkey.example.com +short # Ask an authoritative server to separate publication from recursive cache dig @ns-authoritative.example eb2026._domainkey.example.com TXT +noall +answer # Replace every example with the selector, domain, and authoritative NS you own. ``` Check both the authoritative answer and a normal recursive lookup. GoDaddy notes that DNS updates often appear within an hour but can take up to 48 hours globally; actual observation depends on TTL, caches, delegation, and whether you edited the authoritative zone. Do not repeatedly delete and recreate a correct record while old negative answers remain cached. ## Step 5: verify or enable signing at the provider Some services detect the record automatically; others require Verify, Authenticate, or Start authentication after DNS is public. This step tells the sender it can begin using the corresponding private key. A green DNS check means the public record is reachable; it does not prove production messages are signed with that selector. ## Step 6: inspect a real signed message ### Header evidence ```text DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=eb2026; ... Authentication-Results: mx.receiver.example; dkim=pass header.d=example.com header.s=eb2026; spf=pass smtp.mailfrom=bounce.example.com; dmarc=pass header.from=example.com Confirm: 1. a DKIM-Signature exists 2. d= is the intended signing domain 3. s= is the selector you published 4. the final receiver reports dkim=pass 5. d= aligns with the visible From domain for DMARC ``` Send through the actual production route to an inbox you control and inspect the raw source at the final receiver. A DNS checker cannot see whether an intermediate system rewrote the body, whether the sender chose an old selector, or whether the visible From domain aligns with the valid signature. ## Common GoDaddy DKIM errors ### Symptom-to-cause map ```text SYMPTOM LIKELY CAUSE No record publicly edited non-authoritative DNS or cache/delegation issue NXDOMAIN at expected selector wrong Name, selector, or duplicated base domain CNAME target appears as TXT wrong record type Two records at one selector CNAME conflict or duplicate TXT material Provider says value mismatched truncated/copied value, quotes, whitespace, wrong project DNS verifies but no signature signing not enabled or message used another sender/route dkim=neutral key not found receiver queried different d=/s= than published dkim=fail body hash mismatch message changed after signing dkim=pass but dmarc=fail valid d= does not align with visible From Old messages fail after rotation previous public key removed before all signed mail aged out ``` ## Do not merge DKIM keys from different senders A domain can use several legitimate email services simultaneously. Give each service its own provider-issued selector. Do not paste several p= values into one record, replace a working selector for another service, or point a CNAME selector at two targets. DNS permits only one coherent answer at the selector name, and a CNAME cannot coexist with unrelated data at that name. ### Selector inventory ```text SELECTOR SENDER DOMAIN TYPE OWNER LAST VERIFIED eb2026 Email Bump example.com TXT Product 2026-08-04 google Workspace example.com TXT IT 2026-08-04 crm1 CRM vendor example.com CNAME Lifecycle 2026-08-04 legacy retired ESP example.com TXT none retirement pending Inventory the private-key owner, not only the DNS record. ``` ## Rotate DKIM safely - Create a new key under a new selector at the sending service. - Publish the new TXT or CNAME in GoDaddy and verify it publicly. - Enable the new selector and confirm real messages pass at final receivers. - Monitor old and new selectors in headers and DMARC aggregate reports. - Stop signing with the old selector before removing its public key. - Retain the old record long enough for delayed and queued signed messages to clear under your system's behavior. - Document the rotation, owner, affected streams, rollback, and next review date. ## Frequently asked questions ## Does GoDaddy automatically add DKIM? It can automate records for certain GoDaddy email products when the email and DNS are in the same account. For third-party senders, obtain the service-specific DKIM record and add it to the authoritative DNS zone. Always verify the public selector and a real signed message. ## Should a GoDaddy DKIM record be TXT or CNAME? Either pattern is possible. Use exactly the record type your sending service provides. TXT commonly contains v=DKIM1 and a public p= key; CNAME delegates the selector to a provider hostname. Changing the type breaks the lookup contract. ## Why does DKIM pass but DMARC fail? The DKIM signature validated, but its d= domain did not align with the visible From domain under the domain's DMARC alignment mode. Configure the sender to sign with your aligned domain. A valid provider-owned signature can be useful but does not automatically satisfy DMARC for your From address. ## Verify the complete signing path - [DKIM record checker](https://emailbump.com/tools/dkim-record-checker) — Resolve the selector and inspect version, algorithm, public key, and syntax. - [DKIM key generator](https://emailbump.com/tools/dkim-record-generator) — Generate a selector and key pair only when your own signing system needs one. - [Email header analyzer](https://emailbump.com/tools/email-header-analyzer) — Compare final DKIM signatures, Authentication-Results, SPF, and DMARC alignment. - [Read DMARC reports](https://emailbump.com/blog/read-dmarc-reports) — Monitor selectors, source IPs, raw authentication, and alignment across receivers. ## Sources - [GoDaddy: Add a TXT record](https://www.godaddy.com/help/add-a-txt-record-19232) - [GoDaddy: Add a CNAME record](https://www.godaddy.com/help/add-a-cname-record-19236) - [GoDaddy: Add SPF, DKIM, and DMARC for Professional Email](https://www.godaddy.com/help/add-spf-dkim-and-dmarc-to-my-domain-for-professional-email-42437) - [Google Workspace: Set up DKIM](https://support.google.com/a/answer/174124) - [RFC 6376: DomainKeys Identified Mail](https://www.rfc-editor.org/rfc/rfc6376)