Can I have two SPF records in GoDaddy?

No. SPF allows only one TXT record beginning with v=spf1 per domain. Two records produce a permerror and break authentication. Combine every sending source into a single record instead.

Should I end my SPF record with ~all or -all?

Start with ~all (softfail) while you confirm every legitimate sender is listed. Move to -all (hardfail) once you are certain nothing is missing, so unauthorized senders are rejected outright.

How long does an SPF change take to work in GoDaddy?

Usually under an hour. The old value can linger until the previous TTL expires. Verify with dig TXT yourdomain.com +short or nslookup before assuming it is live.

How to Set Up an SPF Record in GoDaddy

VigilDog Team · August 29, 2026 · 6 min read

An SPF record tells the world which servers are allowed to send email for your domain. Get it right and your mail clears authentication; get it wrong and legitimate messages land in spam or bounce. If your DNS lives at GoDaddy, adding SPF takes about five minutes once you know where the settings hide and what the record should actually say.

What an SPF record in GoDaddy actually does

SPF (Sender Policy Framework) is a single DNS TXT record published on your domain. When a receiving server gets a message claiming to be from you, it reads that record and checks whether the sending IP is on your approved list. There is no separate 'SPF record type' in GoDaddy or anywhere else, it is always a TXT record whose value begins with v=spf1.

SPF is one leg of a three-part stack. SPF authorizes sending servers, DKIM cryptographically signs the message, and DMARC ties the two together and tells receivers what to do on failure. Setting up SPF alone helps, but the real deliverability gains come from all three agreeing. If you are starting from zero, our walkthrough on how to fix SPF, DKIM, and DMARC covers the full picture.

How SPF, DKIM and DMARC verify an email

Where to find DNS settings in GoDaddy

GoDaddy has moved its DNS interface around over the years, but the current path is consistent. Sign in, then open your Domain Portfolio from the account menu. Click the domain you want to edit, and on the domain's page look for the DNS section, the button is usually labeled 'Manage DNS' or simply 'DNS'. That opens the DNS Records table where every A, CNAME, MX, and TXT record for the domain is listed.

Sign in at godaddy.com and open Domain Portfolio.
Select the domain (not a bulk action, click the domain name itself).
Open Manage DNS / DNS to reach the DNS Records table.
Scan the existing TXT records before adding anything, you may already have an SPF record.

Building your SPF record

In the DNS Records table, click Add New Record. Set Type to TXT, set Name (host) to @the @ means the record applies to your root domain, and paste your SPF string into the Value field. Leave TTL at the default (1 hour is fine). A typical record for a domain that sends only through Google Workspace looks like this: v=spf1 include:_spf.google.com ~all.

The mechanisms between v=spf1 and the final all are your authorized senders. Use include: to trust another provider's SPF (Google, Microsoft 365, SendGrid, Mailchimp, etc.), ip4: or ip6: to authorize a specific server address, and mx to authorize whatever your MX records point to. If you send through several services, chain them: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Put every sending source in one record.

The ending matters. ~all (softfail) tells receivers that anything not listed is suspicious but should still be accepted and marked, the safe default while you confirm you have listed every sender. -all (hardfail) tells receivers to reject unlisted senders outright. Move to -all only once you are confident nothing legitimate is missing.

Verify the record and avoid the common traps

Save the record, then wait for propagation, GoDaddy usually applies TXT changes within an hour, though the old TTL can hold the previous value briefly. Confirm the published value with a quick lookup: dig TXT yourdomain.com +short on macOS or Linux, or nslookup -type=TXT yourdomain.com on Windows. You should see exactly one line starting with v=spf1. To check that the whole authentication chain agrees, run your domain through the DMARC checker.

Two mistakes account for most broken SPF. First, having more than one v=spf1 TXT record, SPF permits only one, and a second record makes the result 'permerror', silently failing authentication. Merge everything into a single record instead. Second, blowing the 10 DNS-lookup limit: every include, a, mx, and redirect costs a lookup, and stacking too many providers pushes you over, again causing a permerror. Flatten rarely-changing includes to ip4: entries if you approach the ceiling.

Keep it correct after you walk away

SPF is not set-and-forget. The day you add a new email tool, switch CRMs, or a provider changes its sending IPs, your record can quietly fall out of date, and you usually only find out when a client says your reports stopped arriving. DNS edits at the registrar are easy to make and just as easy to forget.

That is exactly the drift VigilDog watches for. Our monitoring tracks your SPF, DKIM, and DMARC records alongside DNS changes and SSL expiry, and alerts you when something shifts instead of leaving you to notice after deliverability drops. Set the record right today, then let the watchdog tell you the day it needs attention.