Quick answer: to send reliably from GoHighLevel, connect a dedicated sending domain (ideally a subdomain such as mail.yourdomain.com), add the DNS records HighLevel gives you, publish a DMARC record starting at p=none, then verify that SPF, DKIM and DMARC all pass on a real test email. Skipping this step is the most common reason agency campaigns land in spam.
This guide covers what each record does, how to set them up in a GoHighLevel sub-account, how to verify the result, and what to avoid. It assumes you already have a working account. If you are still evaluating the platform, start with the full review first.
Why email authentication is no longer optional
Google and Yahoo tightened their rules for bulk senders. Google treats senders approaching roughly 5,000 messages a day to personal Gmail addresses as bulk senders, and it counts mail across your primary domain and its subdomains together. Bulk senders need both SPF and DKIM, a published DMARC policy, and a visible, one-click unsubscribe method. Both providers expect spam complaint rates to stay below 0.3%, and Google recommends staying under 0.1%.
Even if you send far below that volume, authentication still affects placement. Google publishes its email sender guidelines publicly, and they are worth reading before you configure anything. Agencies are especially exposed: one client with a poor list can damage a shared sending reputation, so each client sub-account should send from its own authenticated domain.
What SPF, DKIM and DMARC each do
SPF (Sender Policy Framework) is a TXT record that lists which servers may send mail for your domain. Receiving servers check the sending server against that list. You may publish only one SPF record per hostname, so if you use several services you must merge them into a single record, and the record must stay within 10 DNS lookups.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. You publish the public key as a TXT record at a hostname in the form selector._domainkey, and receiving servers use it to confirm the message was not altered and was signed by your domain. Google sets a 1024-bit minimum key length and recommends 2048 bits.
DMARC ties the two together. It is a TXT record at _dmarc.yourdomain.com that tells receivers what to do when a message fails authentication, and where to send reports. The key concept is alignment: an SPF or DKIM pass only counts if the domain that passed matches the visible From domain. A pass for an unrelated domain does not authorize your From address.
One more point that trips people up: CNAME records you may see during setup typically support link tracking. They are not authentication records. SPF, DKIM and DMARC are all TXT records.
Choose the right sending domain first
Use a subdomain for marketing and automated email, for example mail.clientdomain.com or news.clientdomain.com, and keep the root domain for one to one business email. This isolates reputation: if a campaign draws complaints, your team's day to day mail is not affected.
Remember that the root domain and the sending subdomain have separate records. Authenticating one does not cover the other. A DMARC record on the root domain applies to subdomains by default, so you usually do not need a second DMARC record for the sending subdomain. If you want a different policy for subdomains, use the sp= tag in the root record.
Avoid sending marketing email from a free address such as Gmail or Outlook. You cannot publish records for those domains, so you cannot align authentication, and Gmail and Yahoo are increasingly strict about it.
Step by step: connect a dedicated sending domain in GoHighLevel
Menu names shift between releases, so treat the path below as a guide and confirm it in your own account.
Step 1: Open the sub-account and go to Settings, then Email Services. Add a dedicated sending domain and enter your chosen subdomain.
Step 2: HighLevel displays the DNS records for that domain, each with a Type, Host and Value. Copy them exactly. Stray spaces, added quotes or a duplicated domain name in the Host field are the most common cause of failed verification, because many DNS providers append the root domain automatically.
Step 3: Add the records at the DNS provider that actually controls the domain. If the domain uses Cloudflare nameservers, add them in Cloudflare, not at the registrar. Do not modify existing MX or unrelated TXT records.
Step 4: Wait for propagation. This can take from a couple of hours to 48 hours, though it is often much faster. Mailbox providers may take several days to fully recognize the change.
Step 5: Return to the sending domain screen and run the verify action. Once it shows verified, set the domain as the default for the sub-account and update your From addresses to use it, for example hello@mail.clientdomain.com.
If you route email through your own provider instead of the built in LC Email service, the records come from that provider and the process differs. Our Mailgun setup guide covers that route in detail.
Publish a DMARC record the safe way
A minimal DMARC record is a TXT record at _dmarc.yourdomain.com that begins with v=DMARC1 and sets p=none. Add an rua= tag pointing at a mailbox you monitor so you receive aggregate reports. A p=none policy satisfies the basic requirement and lets you see who is sending mail as your domain without affecting delivery.
Read the reports for at least two to four weeks. Reports often reveal forgotten senders: an old CRM, a billing tool, a website form plugin. Fix each one by adding it to SPF or configuring DKIM for it. Only then move to p=quarantine, and later p=reject if you want the strictest protection. Jumping straight to reject can block legitimate mail from tools you forgot about.
Use values supplied by your sending service for SPF and DKIM. Do not copy example strings from blog posts, including this one, because the includes and keys are specific to your account.
Verify that authentication actually passes
A verified badge inside HighLevel confirms the DNS records exist. It does not prove mail is passing at the receiving end. Use a lookup tool such as MXToolbox to confirm the published records, then run a real test.
Send a test email from GoHighLevel, using the same route your campaigns will use, to a Gmail address you control. Open the message, choose Show original, and check the Authentication-Results line. You want to see spf=pass, dkim=pass and dmarc=pass. If any shows fail or neutral, check alignment first: the domain in the From address must match the domain that passed SPF or DKIM.
Common mistakes that cause spam placement
Multiple SPF records on the same hostname. Receivers treat this as a permanent error. Merge everything into one record.
Exceeding 10 SPF lookups. Each include counts, and nested includes count too. Trim services you no longer use.
Treating authentication as a guarantee. Passing SPF, DKIM and DMARC removes a barrier but does not guarantee inbox placement. Sender reputation, list quality, engagement and content still decide the outcome.
Blasting a cold list from a new domain. A new sending domain has no reputation. Start with your most engaged contacts, send modest volumes, and increase gradually over several weeks. Keep complaint rates well under the thresholds above.
No unsubscribe handling. Marketing email needs a visible unsubscribe link and a working list-unsubscribe header, and opt-outs should be processed within two days. Use HighLevel's built in unsubscribe handling rather than removing it from templates.
Forgetting the root domain. If the root has no DMARC record, add one. Receivers evaluate the organizational domain too.
What it costs
You do not need a special plan to authenticate a sending domain, but plan choice still matters for agencies. Current plans start at $97 per month (Starter, 3 sub-accounts), $297 per month (Unlimited sub-accounts) and $497 per month (Agency Pro, with SaaS Mode). See our GoHighLevel pricing breakdown for the full picture.
Usage is billed separately. According to a third party pricing breakdown from Apexure, LC Email sending runs about $0.675 per 1,000 emails, email verification about $2.50 per 1,000 checks, and a dedicated sending IP about $59 per month. Those figures come from a secondary source, so confirm current rates in your own billing settings before quoting them to clients. A dedicated IP is only worth it at consistently high volume, because a low volume sender on its own IP struggles to build reputation.
The bottom line
The setup takes under an hour of hands on work plus propagation time, and it is the highest leverage deliverability task in the platform. Use a sending subdomain per client, add the records exactly as shown, start DMARC at p=none, verify with a real Gmail test, and warm up volume slowly. For a broader look at what the platform does well and where it falls short, read our GoHighLevel review.