On this page

Fixing DANE in GoDaddy for Google Workspace

Why you can't fix this

DANE works by publishing a TLSA record on your mail server's own hostname, signed via DNSSEC. See Setting Up DANE for Email for the general mechanism.

Two separate blockers apply here:

  1. Google Workspace itself doesn't support inbound DANE. Your MX records point to Google's infrastructure (smtp.google.com or the legacy aspmx.l.google.com set), which lives in google.com's zone, not yours — there's no TLSA record you could publish that would apply to your inbound mail security.
  2. GoDaddy doesn't support TLSA records at all, even if there were one to add — its supported record types are A, AAAA, CNAME, MX, NS, TXT, SRV, and CAA.

Either one alone would block this; together, there's no path forward while both stay as they are.

What to do instead

Google's documented mechanism for enforcing inbound transport security is MTA-STS, not DANE. Set this up via Menu → Apps → Google Workspace → Gmail → Advanced → MTA-STS in the Google Admin console — it requires only a TXT record and an HTTPS-hosted policy file, both of which GoDaddy can host without issue.

Common pitfalls

  • Assuming a DNS provider switch alone would fix this — even a provider that fully supports TLSA (like Cloudflare) can't make Google publish DANE for its own mail infrastructure.