DMARC for marketing platforms
How do I set up DMARC for GoHighLevel?
A HighLevel LC Email dedicated sending domain uses five records: SPF and DKIM TXT, two MX records and a tracking CNAME, normally on a subdomain.
The DNS records for GoHighLevel
SPF: TXT on your sending subdomain (host is the prefix only, such as lc)
v=spf1 include:mailgun.org ~allEnter only the prefix in the host field. Including the root domain can make verification fail.
DKIM selector: Unique to each domain, shown in the platform
<selector>._domainkey.<prefix> TXT (value from the DNS records screen)HighLevel's examples are mx._domainkey.helpdesk and mailo._domainkey, but they are illustrations. Copy yours from the screen.
MX, priority 10
mxa.mailgun.orgMX, priority 10
mxb.mailgun.orgTracking CNAME
email.<prefix> CNAME mailgun.orgValues in angle brackets are specific to your account. Copy the real ones from GoHighLevel rather than from this page.
Alignment caveats
- ✓If your main domain already has MX records, such as for Google Workspace, use a subdomain to avoid conflicts.
- ✓The setup article does not include a DMARC record, so the subdomain inherits your root policy unless you publish one for it.
- ✓Your From address must be on that subdomain or its parent domain to align under relaxed DMARC alignment. Strict alignment (adkim=s, aspf=s) needs an exact match.
From p=none to p=reject with GoHighLevel
- Publish
v=DMARC1; p=none; rua=mailto:<your-business-id>@mail.yourdmarc.online, or build it with the DMARC generator. Delivery does not change at this stage. - Add the records above, then verify them with the SPF checker and the DKIM checker, entering your selector.
- Check that each sub-account's sending domain shows an aligned pass. Agencies often have several, and every one inherits the root policy.
- Move to
p=quarantinewhen your legitimate mail passes, and watch the reports for anything you missed. - Move to
p=rejectwithsp=reject. Read the enforcement guide for what tends to break, and keep monitoring afterwards.
Sources
Taken from GoHighLevel's own documentation, checked on 1 November 2026. Providers change these, so their setup screen wins over this page.
See how GoHighLevel really does on your domain
Check a real message against the Gmail, Yahoo and Outlook.com sender rules, or test whether a stranger can send mail as your domain. Both are free.
Frequently asked questions
What SPF record does GoHighLevel need?
v=spf1 include:mailgun.org ~all, published as: TXT on your sending subdomain (host is the prefix only, such as lc). Enter only the prefix in the host field. Including the root domain can make verification fail.
What DKIM selector does GoHighLevel use?
Unique to each domain, shown in the platform. HighLevel's examples are mx._domainkey.helpdesk and mailo._domainkey, but they are illustrations. Copy yours from the screen.
Will GoHighLevel mail pass DMARC alignment?
Only once a passing SPF or DKIM result is on your From domain or its organizational domain. If your main domain already has MX records, such as for Google Workspace, use a subdomain to avoid conflicts.
How do I reach p=reject with GoHighLevel?
Start at p=none with a rua address, finish the GoHighLevel setup, then read your reports. Check that each sub-account's sending domain shows an aligned pass. Agencies often have several, and every one inherits the root policy. Move to p=quarantine, then p=reject, once your legitimate mail passes.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
