GoDaddy sold its own mailbox product, Workspace Email, for many years alongside domain registrations and hosting. Its servers run under the secureserver.net name, and Spaw reports domains that still point there as mx_provider: "godaddy". GoDaddy has since moved its email business to Microsoft 365 from GoDaddy, so the classifier label is shrinking.
How GoDaddy shows up in DNS
Legacy Workspace Email domains publish MX records under secureserver.net, historically smtp.secureserver.net at priority 0 and mailstore1.secureserver.net at priority 10. Spaw matches the .secureserver.net suffix. Note that GoDaddy's own domains, including secureserver.net itself, now resolve to mail.protection.outlook.com hosts and classify as microsoft, as do all customers on Microsoft 365 from GoDaddy. If a domain you expected to be GoDaddy-hosted comes back as microsoft, that migration is the reason, and the Microsoft page describes how it behaves.
How GoDaddy answers a verification handshake
The legacy Workspace Email servers typically reject unknown recipients at RCPT TO, so most checks settle in the session. A catch-all mailbox could be configured per domain, and domains with one answer as catch-all. The platform also rate-limits unfamiliar sources, which occasionally defers a probe.
What that means for your verdicts
For domains still on Workspace Email, expect deliverable with mailbox_exists: true, undeliverable with reason: mailbox_not_found and smtp_reason: no_mailbox, or risky with reason: catch_all on domains with a catch-all mailbox. For catch-all domains Spaw returns mailbox_confidence without the established-provider bonus, so the domain's own DMARC and SPF, its age and the shape of the username carry the estimate. There are no consumer username rules for GoDaddy domains.
The more important verdict pattern is around the migration itself. Mailboxes that were not carried over to Microsoft 365 stop existing, so a list collected years ago from small businesses on GoDaddy email tends to produce a wave of mailbox_not_found answers when re-verified now. Those answers are free, and the addresses join your suppression list automatically.
SPF and DMARC at GoDaddy
GoDaddy's help pages ask domain owners to publish v=spf1 include:secureserver.net -all for email on Professional Email, Microsoft 365 from GoDaddy, Linux hosting and their hosting products, adding other services' includes as needed and keeping to a single SPF record. Spaw reports the live state in has_spf and dmarc_policy; a small-business domain without SPF adds ten risk points to its addresses.
Practical notes for sending to GoDaddy-hosted users
GoDaddy's email customers are overwhelmingly small businesses with domains registered years ago, and their lists age quickly. Re-verify before every campaign rather than once a year, and expect role addresses (info@, contact@) to dominate; Spaw flags those risky with reason: role even when they exist. Where a domain has moved to Microsoft 365, the catch-all behaviour common on Exchange Online tenants applies, and mailbox_confidence plus your own delivery feedback are the tools for ranking those addresses.
For a live look at any domain, run it through the free MX lookup and the SPF and DMARC checker.