# GoDaddy Workspace Email: MX records and email verification

How domains on GoDaddy's legacy Workspace Email look in DNS, how they answer a verification handshake, and why most GoDaddy email now classifies as Microsoft.

Updated: 2026-09-03

GoDaddy sold its own mailbox product, Workspace Email, for many years alongside domain registrations and hosting. Its servers run under the `secureserver.net` name, and Spaw reports domains that still point there as `mx_provider: "godaddy"`. GoDaddy has since moved its email business to Microsoft 365 from GoDaddy, so the classifier label is shrinking.

## How GoDaddy shows up in DNS

Legacy Workspace Email domains publish MX records under `secureserver.net`, historically `smtp.secureserver.net` at priority 0 and `mailstore1.secureserver.net` at priority 10. Spaw matches the `.secureserver.net` suffix. Note that GoDaddy's own domains, including secureserver.net itself, now resolve to `mail.protection.outlook.com` hosts and classify as `microsoft`, as do all customers on Microsoft 365 from GoDaddy. If a domain you expected to be GoDaddy-hosted comes back as `microsoft`, that migration is the reason, and the Microsoft page describes how it behaves.

## How GoDaddy answers a verification handshake

The legacy Workspace Email servers typically reject unknown recipients at `RCPT TO`, so most checks settle in the session. A catch-all mailbox could be configured per domain, and domains with one answer as catch-all. The platform also rate-limits unfamiliar sources, which occasionally defers a probe.

## What that means for your verdicts

For domains still on Workspace Email, expect `deliverable` with `mailbox_exists: true`, `undeliverable` with `reason: mailbox_not_found` and `smtp_reason: no_mailbox`, or `risky` with `reason: catch_all` on domains with a catch-all mailbox. For catch-all domains Spaw returns `mailbox_confidence` without the established-provider bonus, so the domain's own DMARC and SPF, its age and the shape of the username carry the estimate. There are no consumer username rules for GoDaddy domains.

The more important verdict pattern is around the migration itself. Mailboxes that were not carried over to Microsoft 365 stop existing, so a list collected years ago from small businesses on GoDaddy email tends to produce a wave of `mailbox_not_found` answers when re-verified now. Those answers are free, and the addresses join your suppression list automatically.

## SPF and DMARC at GoDaddy

GoDaddy's help pages ask domain owners to publish `v=spf1 include:secureserver.net -all` for email on Professional Email, Microsoft 365 from GoDaddy, Linux hosting and their hosting products, adding other services' includes as needed and keeping to a single SPF record. Spaw reports the live state in `has_spf` and `dmarc_policy`; a small-business domain without SPF adds ten risk points to its addresses.

## Practical notes for sending to GoDaddy-hosted users

GoDaddy's email customers are overwhelmingly small businesses with domains registered years ago, and their lists age quickly. Re-verify before every campaign rather than once a year, and expect role addresses (`info@`, `contact@`) to dominate; Spaw flags those `risky` with `reason: role` even when they exist. Where a domain has moved to Microsoft 365, the catch-all behaviour common on Exchange Online tenants applies, and `mailbox_confidence` plus your own delivery feedback are the tools for ranking those addresses.

For a live look at any domain, run it through the free MX lookup and the SPF and DMARC checker.

Reference: https://spaw.co/email-providers/godaddy