How to Fix DNSSEC and Microsoft 365 Email Issues with GoDaddy
Question details
The user is experiencing inconsistent external email delivery in Microsoft 365 due to an incomplete DNSSEC configuration at GoDaddy.
- Product
- Microsoft 365, GoDaddy DNS
- Device & OS
- not provided
- Scenario
- Receiving external emails with a federated Microsoft 365 domain managed by GoDaddy.
- Observed behavior
- Certain external emails fail to arrive. A DNSSEC analyzer reports that DS records are published without corresponding DNSKEY records, indicating a broken DNSSEC chain.
Ensure you have your GoDaddy domain management dashboard credentials ready and obtain a free DNSSEC analyzer report to verify the exact status of your DS and DNSKEY records.
Contact GoDaddy Support to Remove Stale DS Records
Since GoDaddy manages both the domain registration and federated Microsoft 365 administration, their support team must remove invalid DNSSEC entries to restore email flow.
A DS record without a matching DNSKEY record breaks the chain of trust in DNSSEC. This causes strict external email providers to reject delivery to your Microsoft 365 inbox. Because federated admin settings often hide advanced DNSSEC controls, GoDaddy must intervene directly.
Use a public DNSSEC analyzer tool to confirm that your domain's DS records are published without the corresponding DNSKEY records.
Navigate to the DNS Management section for your domain in your GoDaddy account and check for visible DNSSEC settings.
If you cannot manually delete the stale DS records, open a support ticket or call GoDaddy customer service.
Ask the representative to verify the DNSSEC status at both the registrar and DNS provider levels. Request that they remove any remaining DS records, and escalate the case to Microsoft technical support if the issue persists.
Once GoDaddy confirms the changes, wait for DNS propagation to complete and test your incoming mail from an external provider (like Yahoo or an enterprise address).
Looking for a Lightweight Alternative to Microsoft 365?
While you wait for your DNS and email routing issues to be resolved by GoDaddy and Microsoft, consider using WPS Office for your immediate document needs. It offers powerful, locally installed tools for documents, spreadsheets, and presentations without relying on complex cloud administration.
- 1. Visit the WPS Office website: Go to the official WPS website to access the free download.
- 2. Install the software: Follow the straightforward installation prompts to set up the suite on your computer.
- 3. Open your files: Instantly open and edit your existing Microsoft Office documents with perfect formatting.
Frequently Asked Questions
Why am I receiving emails from Gmail but not from other providers?
Different email providers enforce DNSSEC validation at different strictness levels. If your domain has a broken DNSSEC chain (like missing DNSKEY records), strict providers will fail the lookup and drop the connection, while providers with more relaxed validation (like Gmail) might bypass the error and deliver the mail.
What does 'DS record without a matching DNSKEY' mean?
This means your domain registrar (GoDaddy) is telling the internet that your domain uses DNSSEC by publishing a Delegation Signer (DS) record, but your active DNS hosting provider is not publishing the required cryptographic keys (DNSKEY) to prove it. This inconsistency causes lookup failures.
Can I fix the Microsoft 365 DNSSEC issue myself in the admin center?
Typically, no. If your domain is managed through a federated Microsoft 365 setup with GoDaddy, certain advanced DNSSEC settings are locked or hidden in your user interface. You will need GoDaddy support to manually intervene and remove the stale records.
