How to Set Up Email Authentication (SPF, DKIM, DMARC) in GoHighLevel

Proper email authentication is one of the most important — and most overlooked — steps when configuring GoHighLevel for client communication. Without it, your emails are far more likely to land in spam folders, get rejected outright, or fail deliverability checks imposed by major inbox providers like Gmail and Outlook. This guide walks you through setting up SPF, DKIM, and DMARC records for your sending domain inside GoHighLevel.

Note: This is an independent editorial resource. It is not affiliated with, endorsed by, or operated by HighLevel Inc.

---

Understanding SPF, DKIM, and DMARC Before You Configure Anything

Before touching any settings, it helps to understand what each protocol actually does:

• SPF (Sender Policy Framework): A DNS record that tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. If GoHighLevel's sending servers aren't listed, your emails may be marked as spoofed.
• DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to outgoing emails. The receiving server checks this signature against a public key stored in your DNS to verify the message wasn't tampered with in transit.
• DMARC (Domain-based Message Authentication, Reporting & Conformance): Sits on top of SPF and DKIM. It tells receiving servers what to do when an email fails those checks (nothing, quarantine, or reject), and optionally sends you reports about failed authentications.

All three work together. Having only one or two of them configured reduces their collective effectiveness significantly.

---

Step 1 — Connect Your Sending Domain in GoHighLevel

GoHighLevel sends emails either through its own shared infrastructure or through a dedicated sending domain you configure. For serious deliverability, you should use a dedicated domain or subdomain.

1. Log in to your GoHighLevel account and navigate to the Sub-Account (location) where you want to configure email.
2. Go to Settings in the left sidebar.
3. Click on Email Services (the exact label may vary depending on your plan and whether you're using LC Email or a third-party SMTP integration like Mailgun or SendGrid).
4. If you are using LC Email (GoHighLevel's built-in sending layer), locate the Dedicated Domain option and click Add Domain.
5. Enter the domain or subdomain you intend to use for sending (e.g., mail.yourdomain.com). Using a subdomain is a common best practice — it protects your root domain's reputation.
6. GoHighLevel will generate the DNS records you need to add. Keep this screen open.

Important: If you are using a third-party SMTP provider (Mailgun, SendGrid, etc.), the SPF and DKIM records will be provided by that service, not GoHighLevel. The configuration steps below apply to the DNS side regardless of which sending infrastructure you use.

---

Step 2 — Add SPF and DKIM Records to Your DNS

You'll need access to the DNS management panel of the registrar or DNS provider where your domain is hosted (e.g., Cloudflare, GoDaddy, Namecheap, Route 53).

Adding the SPF Record

1. In your DNS provider, create a new TXT record.
2. Set the Host/Name field to @ (for the root domain) or the subdomain prefix (e.g., mail) if you're authenticating a subdomain.
3. Set the Value to the SPF string provided by GoHighLevel or your SMTP provider. It typically looks like: v=spf1 include:sending-server-domain.com ~all
4. Set TTL to 3600 (1 hour) or your provider's default.
5. Save the record.

If you already have an SPF record for that host, do not create a second one. Instead, merge the include: statement into the existing record. Having two SPF records for the same host will cause authentication failures.

Adding the DKIM Record

1. GoHighLevel (or your SMTP provider) will give you a DKIM record — usually a CNAME or TXT record with a specific selector name (e.g., em._domainkey.mail.yourdomain.com).
2. Create the record type indicated (CNAME is most common with managed providers).
3. Paste the Name/Host and Value exactly as shown — these are case-sensitive.
4. Save the record.

After saving both records, return to GoHighLevel and click Verify or Check DNS. DNS propagation can take anywhere from a few minutes to 48 hours, though it's usually faster with modern DNS providers.

---

Step 3 — Configure Your DMARC Record

DMARC requires a TXT record added to your DNS under the specific host _dmarc followed by your domain.

1. In your DNS panel, create a new TXT record.
2. Set the Host/Name to _dmarc (or _dmarc.mail if you're authenticating a subdomain).
3. For an initial, non-restrictive policy, use this value:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

• p=none means no action is taken on failures — it's a monitoring-only mode, appropriate for starting out.
• rua= is where aggregate reports are sent. Use a real mailbox you can access.

1. Save the record.

Once you've monitored reports for a few weeks and confirmed legitimate email is passing authentication, you can gradually move to p=quarantine and eventually p=reject for stronger enforcement.

---

Common Errors and Troubleshooting

Even with careful setup, issues arise. Here are the most frequent problems and how to address them:

Verification still failing after 24 hours Double-check that you added the record to the correct domain zone. A common mistake is adding mail._domainkey.mail.yourdomain.com when the record already includes the root domain implicitly, resulting in a doubled subdomain.

Two SPF records conflict Most DNS providers will warn you, but some won't. Use a tool like MXToolbox's SPF checker to confirm you have exactly one SPF TXT record per host. Merge any duplicates.

DKIM shows as "invalid" in GoHighLevel CNAME records sometimes take longer to propagate than TXT records. Wait the full propagation window and test again using a third-party tool such as mail-tester.com or dmarcian's DKIM inspector before assuming there's a configuration error.

Emails pass SPF but fail DMARC This typically means the "From" domain in your emails doesn't align with the domain in your SPF or DKIM record. DMARC requires alignment — the authenticated domain must match the domain visible in the "From" header. Review your GoHighLevel sending settings to ensure the "From" address uses the same domain you authenticated.

GoHighLevel's DNS check passes, but emails still land in spam Authentication is necessary but not sufficient for good deliverability. Sender reputation, list hygiene, email content, and engagement history all affect inbox placement. Authentication just ensures your emails aren't rejected outright for identity reasons.

---

When GoHighLevel's Email Infrastructure May Not Be the Right Fit

If you're sending very high volumes of transactional email (hundreds of thousands per month), or if you need granular delivery analytics and bounce management at scale, a dedicated transactional email platform (such as Postmark or Amazon SES configured independently) may give you more control than GoHighLevel's built-in LC Email layer. GoHighLevel's email tools are well-suited for CRM-driven marketing and follow-up sequences, but they are not a replacement for specialized deliverability infrastructure in high-volume or compliance-sensitive environments.

Once your SPF, DKIM, and DMARC records are verified and propagated, your sending domain will meet the baseline authentication requirements expected by Gmail, Yahoo, and other major inbox providers — giving your outbound campaigns and automations the best possible chance of reaching the inbox.