Configure and Verify DNS Records for GoHighLevel Email

If your HighLevel cold emails and automations are landing in spam—or you’re staring at a red “Unverified” badge in the dashboard—you likely have a syntax error or a proxy conflict in DNS. Here’s the exact checklist and terminal testing workflow I use to configure, verify, and lock down dedicated email domains in HighLevel without waiting around for blind DNS propagation.

When you configure a dedicated sending domain in LeadConnector (LC) Email, HighLevel asks for five DNS records to manage routing, authentication, and reputation. Mess up a single TXT or MX entry, and you’ll break both outbound delivery and inbound reply webhooks.

The 5 DNS Records GoHighLevel Requires

HighLevel’s LC Email backend runs on Mailgun’s infrastructure and validates domain ownership across five entries. You’ll see these generated inside your agency or sub-account location settings:

• SPF (TXT Record): Authorizes HighLevel’s mail servers to send on behalf of your domain name.
• DKIM (TXT Record): The public cryptographic key matching the private key HighLevel uses to sign outbound message headers.
• Tracking (CNAME Record): Rewrites tracking links and open pixels so deliverability metrics route through your brand rather than a shared hostname.
• Inbound Routing (MX Records – Priority 10): Two records that capture inbound replies and route them straight back to the HighLevel Conversations inbox.
• DMARC (TXT Record): Tells inbox providers (Gmail, Yahoo, Outlook) what to do if SPF or DKIM checks fail.

If you’re also setting up funnel or sub-account URLs, check out our guide on how to connect Cloudflare custom domains to GoHighLevel so your website records don’t collide with your mail setup.

Dedicated Subdomain vs. Root Domain

Never point your primary root domain (like example.com) to HighLevel for email if you already run Google Workspace, Microsoft 365, or Zoho there. Overwriting your apex MX records will take down your entire corporate inbox.

Instead, use an isolated sending subdomain. These are standard conventions inbox providers handle well:

• mg.yourdomain.com (Mailgun’s standard default)
• mail.yourdomain.com (Clean and universal)
• send.yourdomain.com (Great for marketing campaigns)
• replies.yourdomain.com (Ideal for conversational workflow triggers)

For the UI steps inside the app itself, see our walkthrough on setting up a dedicated email sending domain in GoHighLevel LC Email.

Exact Record Formats for Your DNS Panel

Here’s what the standard record set looks like for a dedicated subdomain (using mg.yourdomain.com as our example). Replace yourdomain.com with your domain.

In raw BIND syntax, the zone layout looks like this:

; TXT Records (SPF & DKIM)
mg.yourdomain.com. IN TXT "v=spf1 include:mailgun.org ~all"
krs._domainkey.mg.yourdomain.com. IN TXT "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3..." ; CNAME Record (Link Tracking)
email.mg.yourdomain.com. IN CNAME mailgun.org. ; MX Records (Inbound reply catching - Priority 10)
mg.yourdomain.com. IN MX 10 mxa.mailgun.org.
mg.yourdomain.com. IN MX 10 mxb.mailgun.org.

If your agency uses custom white-label hostnames, swap out mailgun.org for leadconnectorhq.com or your specific agency host shown in the dashboard. You can also review how to set up a whitelabel domain for your GoHighLevel web app if you’re running custom branding across the platform.

Step-by-Step: Adding Records in Your DNS Manager

Whether you’re using Cloudflare, GoDaddy, Namecheap, or Route 53, here’s how to punch these in without hitting syntax errors:

1. Open your DNS provider and load the zone for your root domain (yourdomain.com).
2. Add the SPF TXT Record:
   • Name/Host: mg (or mg.yourdomain.com if your registrar doesn’t auto-append the root zone).
   • Value: v=spf1 include:mailgun.org ~all (or the exact string LC Email provides).
   • TTL: Auto or 300 seconds (5 minutes).
3. Add the DKIM TXT Record:
   • Name/Host: krs._domainkey.mg (or k1._domainkey.mg depending on the selector you were assigned).
   • Value: Paste the full public key string starting with k=rsa; p=....
   • TTL: Auto or 300 seconds.
4. Add the CNAME Tracking Record:
   • Name/Host: email.mg
   • Target/Value: mailgun.org (keep Cloudflare proxy disabled—see below).
5. Add the Two MX Records:
   • Record 1: Host mg, Priority 10, Target mxa.mailgun.org
   • Record 2: Host mg, Priority 10, Target mxb.mailgun.org

If you’re stuck on GoDaddy’s interface, check our walkthrough on connecting a GoDaddy domain to GoHighLevel to see how their UI handles sub-level host formatting.

Verify DNS Propagation from the Command Line

Don’t just mash the “Verify Domain” button in HighLevel to debug an issue. Query DNS directly from your terminal with dig to see what authoritative resolvers are actually returning.

Here is a quick script to query Google (8.8.8.8) and Cloudflare (1.1.1.1) for all five records in one pass:

# Replace with your subdomain
TARGET_DOMAIN="mg.yourdomain.com" echo "=== 1. Checking SPF TXT Record ==="
dig TXT $TARGET_DOMAIN @8.8.8.8 +short echo "=== 2. Checking DKIM Record ==="
dig TXT krs._domainkey.$TARGET_DOMAIN @8.8.8.8 +short echo "=== 3. Checking Inbound MX Records ==="
dig MX $TARGET_DOMAIN @8.8.8.8 +short echo "=== 4. Checking Tracking CNAME ==="
dig CNAME email.$TARGET_DOMAIN @8.8.8.8 +short

If you get empty results, either your DNS host hasn’t published the changes yet, or your host field accidentally duplicated your domain name (e.g., mg.yourdomain.com.yourdomain.com).

3 DNS Gotchas That Break HighLevel Email Verification

In almost every verification failure I’ve debugged, the culprit was one of these three issues:

1. The Cloudflare Orange-Cloud Proxy Bug

Cloudflare proxies CNAME records through its CDN by default (orange cloud). When this is on, HighLevel’s verification worker fails immediately because it sees Cloudflare Anycast IPs instead of the mailgun.org canonical target.

The Fix: Switch the CNAME record for email.mg from Proxied to DNS Only (grey cloud). MX and TXT records can’t be proxied, but double-check that no Page Rules or Workers are interfering.

2. The Duplicate Root Append

Registrars differ on how they handle subdomains. In Cloudflare and Namecheap, entering mg.yourdomain.com in the Host field silently creates mg.yourdomain.com.yourdomain.com.

The Fix: If your DNS editor displays your domain name right next to the input box, enter only the prefix: mg instead of mg.yourdomain.com, and krs._domainkey.mg instead of the full FQDN.

3. Multiple SPF Records on the Same Subdomain

Under RFC 7208 section 3.2, a domain cannot publish multiple SPF TXT records. If you have two records starting with v=spf1 on the same subdomain, receiving mail servers throw a PermError and HighLevel will fail verification.

The Fix: Merge multiple includes into a single record:

; BAD: Two separate TXT entries on mg.yourdomain.com
v=spf1 include:mailgun.org ~all
v=spf1 include:_spf.google.com ~all ; CORRECT: Combined single SPF TXT entry
v=spf1 include:mailgun.org include:_spf.google.com ~all

When you’re using a dedicated subdomain like mg, it should only carry the HighLevel/Mailgun SPF mechanism. Leave your root domain SPF untouched.

Adding DMARC for 2024+ Deliverability Standards

Google and Yahoo enforce strict DMARC alignment for high-volume senders. HighLevel will let you verify a domain without DMARC, but your emails will struggle to reach primary inboxes without it.

Add a TXT record at _dmarc on your root domain (or directly on your sending subdomain if you want an isolated policy):

Here’s a standard relaxed policy for monitoring:

; Host: _dmarc.yourdomain.com (or _dmarc.mg.yourdomain.com)
; Type: TXT
; Value:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; sp=none; aspf=r; adkim=r;

Once you confirm clean delivery with tools like dmarcian or MXToolbox, step up from p=none to p=quarantine or p=reject to stop domain spoofing.

Testing Inbound Reply Forwarding

The two MX records (mxa.mailgun.org and mxb.mailgun.org) route incoming contact replies straight into your sub-account’s conversation stream.

Once HighLevel shows green checkmarks, test the complete inbound loop:

1. Create a test contact in your sub-account using your personal email.
2. Send a manual email from HighLevel to that contact.
3. Open your personal inbox and check the raw headers. Confirm you see SPF: PASS, DKIM: PASS, and DMARC: PASS.
4. Hit Reply and send a test message back.
5. Wait 15–30 seconds and check the Conversations tab in HighLevel. The reply should thread directly under the contact.

FAQ: GoHighLevel Email DNS Records

How long does HighLevel domain verification take?

With Cloudflare or any modern DNS provider on low TTL (300s), verification usually takes under two minutes. Registrars with default 24-hour TTLs can take anywhere from 2 to 12 hours. Run dig queries locally to make sure the records resolve publicly before hitting “Verify” in HighLevel.

Why does HighLevel show DKIM as unverified when the TXT record exists?

2048-bit DKIM keys exceed 255 characters. Some registrars silently truncate long strings. If yours cuts off the key, wrap the value in double quotes or use their multi-string input option.

Can I send emails from different sender addresses on the same verified subdomain?

Yes. Once mg.yourdomain.com is verified, you can send from sales@mg.yourdomain.com, support@mg.yourdomain.com, or any custom user address configured in HighLevel Settings or workflow “From Email” fields.

Do I need to delete my existing Google Workspace MX records?

No. As long as you used a dedicated subdomain (like mg.yourdomain.com), your root domain’s MX records for Google Workspace or Microsoft 365 remain completely untouched.

Next Steps

Once your DNS records show green checkmarks across the board in HighLevel, make sure your email templates handle missing contact fields gracefully. See our guide on how to set fallback default values for merge fields in GoHighLevel.