• GoDaddy’s Default DMARC Policy Shift – What It Means for Your Domain Security

GoDaddy’s Default DMARC Policy Shift – What It Means for Your Domain Security

Blog, ESP Alignment

Starting April 2025, GoDaddy applies a default DMARC quarantine policy on new domains. Learn what this means for email security and domain owners.

by Yunes Tarada

Last Updated:
Reading Time: 3 min
GoDaddy’s Default DMARC Policy Shift – What It Means for Your Domain Security
Table Of Contents−

Key Takeaways

  • GoDaddy now applies a default DMARC quarantine policy to all new domains.
  • This improves email security by preventing spoofed emails from reaching inboxes.
  • It is a positive step toward simplifying domain security implementation for new users and domain owners. 
  • This may not be the whole solution, as the reject policy offers stronger protection by blocking unauthenticated emails entirely.
  • PowerDMARC helps businesses go beyond default settings with automated DMARC enforcement, detailed reporting, and advanced policy management.

Cybercriminals continue to exploit weak domain configurations for phishing, spoofing, and other email-based attacks. Recognizing this, GoDaddy, one of the world’s largest domain registrars, recently announced that starting April 2025, all new domains will automatically include a DMARC policy set to quarantine in the DNS configuration. 

What does this mean for domain owners, MSPs, and email security as a whole?

What Has Changed? GoDaddy’s Default DMARC Policy 

From April 2025, GoDaddy has taken the following DMARC initiatives: 

  • All newly registered or transferred domains now ship with a default DMARC record.
  • The initial policy is set to quarantine, meaning emails failing authentication are sent to spam/junk folders.
  • This follows M3AAWG best practices to enhance protection against spoofing.
  • They are also actively exploring ways to extend DMARC protection to the current domains of their existing customers.  

Why This Move Matters for Domain Owners

Protects Domains from Day 1

Domain owners no longer need to configure DMARC to achieve baseline email protection manually, significantly reducing complexity and manual effort. This is especially helpful for domain owners who don’t have the required expertise in configuring complex DNS protocols.

Reduces Spoofing Attacks

Having a quarantine policy as a default prevents attackers from easily impersonating domain-based emails. While not the strictest policy that DMARC offers, quarantine helps receivers review messages before they land directly in their main inbox

Encourages Best Practices

This initiative nudges customers toward adopting stronger email security setups.

Why GoDaddy’s DMARC Quarantine Policy Isn’t Enough 

GoDaddy’s default DMARC quarantine policy is a meaningful improvement over having no DMARC protection at all, as it helps prevent spoofed emails from landing directly in recipients’ inboxes. However, quarantine is not as stringent as a reject policy, which blocks unauthenticated emails from being delivered altogether.

Additionally, many organizations still rely on monitoring-only policies (p=none) for long terms, which provide visibility but offer no active protection against spoofing threats.

For true email security, domain owners must go beyond default settings by carefully customizing their DMARC policies to reflect their specific email infrastructure, risk tolerance, and business objectives. This ensures both robust protection and reliable email deliverability.

How PowerDMARC Helps You Take It Further

PowerDMARC empowers organizations and MSPs to go beyond default configurations. With our platform, you can:

  • Transition from quarantine to reject policies safely.
  • Access detailed reporting and analytics to monitor DMARC performance.
  • Automate SPF and DKIM configurations, ensuring proper alignment.
  • Leverage advanced email authentication with MTA-STS to secure inbound emails and BIMI to enhance brand visibility and trust.

Implications for MSPs and Resellers

MSPs managing multiple client domains should view GoDaddy’s move as an opportunity to upsell advanced DMARC management services. Automation simplifies onboarding, but fine-tuning policies and providing expert support will be key value propositions.

Final Words

GoDaddy’s initiative marks progress in securing millions of domains by default. However, enterprise-grade domain protection requires active management, continuous monitoring, and the right expertise. PowerDMARC helps businesses and MSPs optimize their DMARC strategy, turning default protection into full-scale email authentication success. Contact us to learn more today!

Latest posts by Yunes Tarada (see all)
Last Updated:
M&A Cybersecurity: The Role of Virtual Data Rooms in Protecting DealsM&A-Cybersecurity--The-Role-of-Virtual-Data-Rooms-in-Protecting-Dealsindustry-phishingIndustry Phishing: How Phishing Attacks Target Different Sectors