On this page

Fixing DANE in GoDaddy for Microsoft 365

What this fixes

DANE lets receiving mail servers verify your mail server's certificate through DNS instead of a public CA. See Setting Up DANE for Email for the general mechanism — this guide covers the Microsoft 365 + GoDaddy specific path.

This isn't a record you hand-author. GoDaddy doesn't support TLSA records directly, but that turns out not to matter here: Microsoft 365 supports "Inbound SMTP DANE with DNSSEC" as a managed feature where Microsoft provisions and publishes the TLSA record on its own infrastructure — not yours. All you need from GoDaddy is DNSSEC and a standard MX record, both of which GoDaddy supports.

Step 1: Enable DNSSEC in GoDaddy

Follow Fixing DNSSEC in GoDaddy first — DANE can't be enabled until DNSSEC is active and validating on your domain. Note GoDaddy's DNSSEC support varies by TLD; if it's unavailable for your domain, this path is blocked regardless of the Microsoft 365 steps below.

Step 2: Enable DNSSEC in Microsoft 365

  1. In Exchange Online PowerShell, run Enable-DnssecForVerifiedDomain for your domain.

Step 3: Swap in Microsoft's DANE-specific MX record

  1. Microsoft will provide a new MX target ending in .mx.microsoft (distinct from the standard mail.protection.outlook.com MX record).
  2. In GoDaddy's DNS records for your domain, edit your existing MX record (or add the new one) to point to the .mx.microsoft hostname Microsoft gave you.
  3. Once mail flow is confirmed working on the new MX record, remove the old mail.protection.outlook.com MX entry.

Step 4: Turn on inbound SMTP DANE

  1. In Exchange Online PowerShell, run Enable-SmtpDaneInbound for your domain.
  2. Microsoft automatically provisions the TLSA record on its .mx.microsoft hostname — GoDaddy's lack of TLSA support is not a blocker here, since you never create one yourself.
  3. Re-run your scan to confirm.

Limitations

  • Not supported for self-service/"viral" sign-up domains, or your tenant's own *.onmicrosoft.com domain.
  • Microsoft recommends keeping an MTA-STS policy active alongside DANE.

Common pitfalls

  • Assuming GoDaddy's lack of TLSA support rules this out entirely — it doesn't, since Microsoft handles the TLSA record itself.
  • Skipping DNSSEC, or discovering your TLD isn't supported by GoDaddy's DNSSEC offering — that's the real blocker to check first.