GoDaddy email with no SPF record: the 10-minute fix

In October 2026 I looked up the public email records of 19,113 small-business domains that receive mail. 1,017 of them use GoDaddy's own email (their mail servers are at secureserver.net). 83.2% of those publish no SPF record, the one line of DNS that tells Gmail and Outlook which servers may send email for the domain. Without it, anyone can send mail that claims to come from the business, and the business's own email is more likely to land in spam.

Email host	Domains	No SPF	No DMARC	Neither
GoDaddy email	1,017	83.2%	85.4%	80.5%
Google Workspace	6,570	36.2%	58.7%	28.6%
Microsoft 365	4,238	1.9%	47.1%	1.3%
Other hosts	7,288	17.3%	57.9%	15.8%

Microsoft 365 asks for the SPF record as a step of connecting a domain, which is likely why almost every Microsoft domain has one. GoDaddy email works without it, so most domains on it can go years unprotected without anyone noticing. On 14 October 2026 I re-checked 60 of the GoDaddy domains with no SPF record: 59 still had none, and 1 had pasted its server name in front of the record (a2plcpnl0712.prod.iad2.secureserver.net: v=spf1 ...), which makes it invalid.

Check yours

Runs in your browser over public DNS; nothing is stored or sent to me. It shows SPF, DKIM and DMARC for the domain and the exact records it is missing.

The fix in GoDaddy DNS

This is for domains whose email is GoDaddy email (Workspace Email or the older cPanel mail). If you moved your email to Microsoft 365 or Google, use the check above instead; it gives the right value for your host.

Sign in at godaddy.com, open My Products, and next to your domain choose DNS (or Manage DNS).
Look through the TXT records for one whose value starts with v=spf1. If there is one, edit it rather than adding a second: a domain may have only one SPF record, and two count as a failure.

Otherwise choose Add New Record and enter:

Type   TXT
Name   @
Value  v=spf1 include:secureserver.net ~all
TTL    1 Hour

Add DMARC, which tells receivers what to do with mail that fails, and sends you a daily report of who is sending as you:
```
Type   TXT
Name   _dmarc
Value  v=DMARC1; p=none; rua=mailto:you@yourbusiness.com
TTL    1 Hour
```
Put an address you actually read in place of you@yourbusiness.com.
Wait an hour and run the check again. When the reports show every real sender passing (one to two weeks), change p=none to p=quarantine; that is the step that sends forged mail to spam.

Before you save, list everything that sends email as you. The website's contact form, an invoicing or booking system, a newsletter tool, a payment app. Each one needs its own include: in the same single SPF line, for example v=spf1 include:secureserver.net include:<the service's value> ~all. Leave one out and its genuine messages start failing once DMARC is tightened. The service's help pages name the include to use.

Why it matters now

Since February 2024 Gmail and Yahoo require SPF or DKIM on mail sent to their users. Without SPF, your own quotes and invoices are more likely to land in spam.
Invoice fraud starts with an email that looks like it came from you. With no SPF and no DMARC, nothing tells the receiver it did not.
It costs nothing: these are free DNS records at the domain company you already pay.

Rather have it done?

$75, fixed. I add the records at GoDaddy, check every service that sends as you so none of your real email breaks, and you pay only after the check above shows your domain protected. No password shared: GoDaddy lets you invite a helper with Delegate Access and remove it afterwards.

Email me to fix it

Opens your email app. Or write to s.n.psaradellis@gmail.com.

How these numbers were made

25,223 business domains taken from OpenStreetMap listings across US metro areas (shops, restaurants, trades, offices), looked up once each in October 2026: MX, the TXT record starting v=spf1 at the domain, and DMARC at _dmarc. 19,113 receive mail; the host is read from the MX names (secureserver.net = GoDaddy email). A record with anything in front of v=spf1 is counted as no SPF, because receivers ignore it. Full method and the other findings: Most small businesses can be impersonated by email. Business listings © OpenStreetMap contributors (ODbL).

Who: Stephen Psaradellis, Arlington Heights, Illinois. An AI system I run did the lookups and wrote this page; I am responsible for the work and the result. All examples · a worked DMARC example.