How to set up SPF, DKIM & DMARC for GoHighLevel

GoHighLevel's Dedicated Domain & IP setup walks you through adding a sending subdomain and generates the exact records your account needs — the values below are per-account, so copy them from the wizard rather than this page.

SPF, DKIM, and CNAME (from the wizard)

Go to Settings → Email Services → Dedicated Domain & IP → Add Domain, and enter a sending subdomain (e.g. mail.yourdomain.com — GoHighLevel recommends a subdomain, not your root domain). After adding it, open the three-dot menu → Verify domain to see every record it needs.

Type	`TXT`
Host / Name	`mail` Your chosen sending subdomain.
Value / Content	`v=spf1 include:[value from wizard] ~all` Example only — the exact include: value is shown on the domain's DNS-records screen — copy it directly.

Type	`CNAME`
Host / Name	`[selector]._domainkey.mail` Exact selector shown in the wizard.
Value / Content	`[target shown in wizard]` Example only — GoHighLevel generates the DKIM CNAME target per account.

Settings → Email Services → Dedicated Domain & IP → Add Domain, using a subdomain.
Open the domain's three-dot menu → Verify domain to list every required record (SPF, DKIM, CNAME, sometimes MX).
Publish each record exactly as shown — or use Auto-Configure if your DNS provider is supported, which applies them for you.
Return to the domain list and confirm it shows verified.

DMARC

DMARC is per-domain, not per-provider — one record at _dmarc.yourdomain.com covers GoHighLevel and everything else that sends as you. Start in monitor-only mode:

Type	`TXT`
Host / Name	`_dmarc` Some providers want the full _dmarc.yourdomain.com here.
Value / Content	`v=DMARC1; p=none; rua=mailto:your-report-address` Example only — replace your-report-address — our DMARC generator builds the record, or sign up free and we generate it with a report address that feeds your monitoring dashboard.

Provider note: Records are published on the sending subdomain, which aligns with your root domain under DMARC's default relaxed mode. Verify the subdomain shows fully verified before relying on it — an incomplete setup authenticates as GoHighLevel's shared infrastructure instead.

Full walkthrough: how to set up DMARC without breaking your email, and why aligned authentication is what DMARC actually checks.

Verify it worked

After DNS propagates (minutes to an hour), send a message from GoHighLevel to our inbox test — it shows the real SPF/DKIM/DMARC verdicts a receiver computes, including whether authentication aligned with your domain. Then HealthCheck Email keeps checking daily and alerts you when a record breaks.

Records current as of 2026-07-14. Provider dashboards change — the authoritative reference is GoHighLevel's official docs.