GoHighLevel Email Deliverability: SPF, DKIM and DMARC Done Right

Email deliverability problems in GoHighLevel almost never look like problems. Nothing errors. The workflow reports sends. The stats show opens — just fewer than they should be. By the time an agency notices, a client has spent three months emailing the spam folder.

Deliverability is not a setting you switch on. It is three DNS records, one sending domain decision and two ongoing habits. Here is the whole thing in order.

First: separate the two things that get confused

Delivery means the receiving server accepted the message. Deliverability means it reached the inbox rather than the spam folder. GoHighLevel reports the first. Nobody reports the second, which is why it goes unnoticed.

The practical consequence: a 99% delivered rate proves nothing on its own. Read it alongside open rate, and treat a sudden open-rate drop with unchanged delivery as a deliverability event until proven otherwise.

Step 1 — Use a dedicated sending domain, and never the client’s bare root

Send from a subdomain — mail.clientdomain.com or go.clientdomain.com — rather than from the root domain. Two reasons, both of which matter later:

• Reputation isolation. Marketing traffic builds its own reputation on the subdomain. If a campaign goes badly, the client’s ordinary business email from the root domain is not dragged down with it.
• Clean separation from their existing mail. The client is probably on Google Workspace or Microsoft 365 at the root. Adding a second SPF include there is the fastest way to break their day-to-day email, which is a far more expensive mistake than a campaign underperforming.

Never send from a free-mail From address — a Gmail or Yahoo sender on bulk mail fails DMARC alignment at the receiving end by design.

Step 2 — The three DNS records

GoHighLevel gives you the exact values when you add the sending domain. Add them at the DNS host, then verify inside the platform rather than assuming.

SPF

A TXT record listing who is allowed to send for that domain. The rules that trip people up:

• One SPF record per domain. Two TXT records both starting v=spf1 is a permanent fail, not a merge. If a record already exists, add the include to it — do not create a second.
• Ten DNS lookups maximum. Each include: counts, and nested includes count too. Agencies that stack CRM, helpdesk, invoicing and newsletter tools blow this limit and everything begins failing at once.
• End with ~all or -all. +all authorises the entire internet to send as the domain.

DKIM

A cryptographic signature proving the message was not altered and genuinely came from the domain. GoHighLevel supplies the record; your only job is to paste it exactly. The two failure modes are a DNS host that silently appends the domain to the record name (producing selector._domainkey.domain.com.domain.com) and a value truncated on paste.

DMARC

The policy that tells receivers what to do when SPF and DKIM disagree — and, more usefully, the record that makes them send you reports.

Publish it in stages. Start at p=none with a reporting address, read the reports for a few weeks, confirm your legitimate sources are all passing, then move to p=quarantine and eventually p=reject. Publishing p=reject on day one, before you know every system that sends as the domain, is how invoices and calendar invites start vanishing.

Step 3 — Meet the bulk sender requirements

The major mailbox providers now enforce requirements on anyone sending at volume to their users. Three of them decide whether your mail is treated as legitimate:

• Authentication — SPF and DKIM passing, with DMARC published. This is step 2.
• One-click unsubscribe — the List-Unsubscribe header, honoured promptly. Do not rely on a link in the footer alone.
• A low spam-complaint rate — the thresholds are strict, and sustained complaints cause filtering regardless of perfect DNS.

That third point is the one no configuration fixes. Complaint rate is a function of who you email and how often, not of your records.

Step 4 — Warm up, then stay boring

A brand-new sending domain has no reputation. Blasting fifty thousand contacts on day one from a fresh subdomain produces exactly the outcome it looks like it should.

Start with your most engaged segment — recent buyers, recent enquiries — and small volumes. Increase gradually over two to four weeks, and watch open rates rather than send counts as the signal to go faster.

Then keep the list clean. Suppress hard bounces immediately, and remove contacts who have not opened anything in six months. Counter-intuitively, mailing fewer people improves results, because engagement rate is itself a ranking input at the receiving end.

The five-minute diagnostic

When a client says “our emails stopped working”, check in this order:

1. Is the sending domain still verified in the sub-account? Domain verification breaks when DNS is migrated.
2. Send one message to a personal Gmail address and open the raw headers. SPF, DKIM and DMARC each report pass or fail there, plainly.
3. Check for a second SPF record — the most common cause after a DNS migration.
4. Compare open rate over the last 30 days against the 30 before. A step change dates the event, and the date usually identifies the cause.
5. Check what changed in sending behaviour around that date — a bought list, a re-engagement blast to dormant contacts, a workflow that started firing twice.

That last one is worth ruling out early: a duplicated send is read as aggressive volume even when the content is fine. If a workflow is re-firing, the Allow Re-Entry setting is usually why.

SMS and email are separate systems

Worth stating plainly because agencies conflate them: none of the above affects SMS, and A2P registration does nothing for email. They are different networks with different gatekeepers, and each needs its own setup. The SMS half is in A2P 10DLC Registration in GoHighLevel.

Related: Conversation SLA setup, Goal Events and skip-ahead logic, Math Operations for lead scoring — engagement scoring is a practical way to keep a list clean — and the Stale Opportunity trigger.

Provider requirements and thresholds change. Verify current values with your DNS host and the receiving providers before promising a client a number.

We build your GoHighLevel account for you

CRM, pipelines, funnels, SMS and automation — configured for your business, not left for you to figure out.

• Setup (one-time)$850
• Ongoing (per month)$38.80

Get my free setup quote

No obligation quote · reply within 1 business day

This site is independently operated and is not officially affiliated with, endorsed by, or sponsored by HighLevel LLC. We do not receive referral commissions — this is our own flat-fee implementation service.