DMARC at Cloudflare and GoDaddy: adding the record
The exact place to add a DMARC record in Cloudflare and in GoDaddy, what Cloudflare DMARC Management changes, and which report address to keep.
A DMARC record is a TXT record named _dmarc on your domain. Where you add it depends on who runs your DNS, which is not always your registrar: a domain bought at GoDaddy may use Cloudflare’s DNS, and the other way round. Check the name servers first; the DNS map shows them. This guide follows Cloudflare’s and GoDaddy’s help pages, read on 15 November 2026.
The record to start with, whichever the provider:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.comThe DMARC generator writes one with your own address.
Cloudflare
The record itself. In the dashboard, choose the domain, then DNS → Records → Add record. Type TXT, name _dmarc, content the value above. Proxy settings do not apply to TXT records.
DMARC Management. Cloudflare also offers a free report service, available on every plan for domains whose DNS is at Cloudflare, under Email → DMARC Management. It works on the apex domain only, not on subdomain setups. When you enable it, Cloudflare reads your existing record and adds its own reporting address to the rua= tag, so that it can process the reports and show you which sources pass. Keep your own address in rua= as well if you want the raw reports.
Cloudflare’s page also warns that it cannot update DNS records held outside Cloudflare: an SPF change there can make your DMARC policy fail. Make such SPF changes directly at the DNS provider that holds them.
GoDaddy
Sign in to the Domain Portfolio, select the domain, then DNS → Add New Record. Type TXT, name _dmarc, value the record above, TTL left at the default. Changes usually apply within an hour, sometimes up to 48 hours.
Three points from GoDaddy’s own pages:
-
GoDaddy adds DMARC automatically to domains bought since April 2025, and says it will add it to older ones too. Look at the DNS list before adding a record: if
_dmarcis already there, edit it instead. -
GoDaddy’s examples go straight to
p=quarantine. That is fine if every service you send with is already authenticated; otherwise start atp=noneand read the reports first, or your invoices may end in spam. -
For GoDaddy hosting e-mail, its example sends reports to a GoDaddy address (
rua=dmarc_rua@onsecureserver.net). Add your own address next to it, separated by a comma, so that you see the reports too.
These instructions apply only when the DNS is managed at GoDaddy.
Then
Check that there is exactly one record with the DMARC checker, read the reports with the DMARC report reader, and when everything that sends in your name passes, follow From p=none to p=reject.