How to Set Up a Custom Whitelabel Domain in GoHighLevel

When you onboard clients to HighLevel, sending them to app.gohighlevel.com breaks the illusion of running your own software platform. We’re going to set up your custom whitelabel domain so clients log into app.youragency.com with your logo, favicon, and a valid SSL cert.

Getting this right comes down to one specific CNAME record, the right agency settings, and dodging Cloudflare proxy issues that break automatic SSL issuance. Here’s how to wire it up from DNS to the login screen.

Portal Domain vs Funnel Domain vs Email Sending Domain

Before touching DNS, make sure you know which domain does what. HighLevel uses domains in three completely separate places, and mixing them up will break your routing:

• Agency Whitelabel Portal Domain: The login URL where you and your sub-account users access the CRM dashboard (e.g., app.youragency.com).
• Funnel and Website Domain: The public domains hosting landing pages and client sites (e.g., www.youragency.com). If you need those, check out our guide on how to connect a custom domain and subdomain to GoHighLevel funnels.
• Dedicated Email Sending Domain: The subdomain used for transactional and marketing emails via Mailgun or LC Email (e.g., replies.youragency.com). Follow our tutorial to set up a dedicated email sending domain in GoHighLevel for that step.

Never point your apex root domain (youragency.com) to the whitelabel portal. Always use a dedicated subdomain like app.youragency.com, portal.youragency.com, or login.youragency.com.

Step 1: Create the CNAME Record in Your DNS Provider

Log in to your DNS provider (Cloudflare, Route 53, Google Cloud DNS, or your registrar) and add a new CNAME record pointing your subdomain to HighLevel’s application target.

Here’s what the zone entry looks like:

Type: CNAME
Name: app
Target: app.msgsndr.com
TTL: Auto (or 300 / 5 minutes)

Older docs might tell you to target app.gohighlevel.com. Both resolve, but HighLevel routes whitelabel portals through app.msgsndr.com for seamless SSL provisioning across their edge infrastructure.

Step 2: The Cloudflare Proxy Gotcha (Error 525 and SSL Loops)

If you use Cloudflare, this is where most setups blow up. When you create a CNAME with Cloudflare’s orange cloud enabled (Proxied), Cloudflare terminates SSL at its edge before forwarding traffic to HighLevel.

The problem: HighLevel tries to generate its own Let’s Encrypt SSL cert for your domain via an HTTP-01 challenge. Cloudflare’s proxy intercepts that challenge, verification fails, and your users get hit with an SSL handshake error (Error 525/526) or an infinite redirect loop.

You have two ways to handle this:

1. Method A (Recommended): Set the Cloudflare Proxy status to DNS Only (Grey Cloud) for the app record. HighLevel handles certificate issuance and auto-renewals on its own.
2. Method B: If you really need Cloudflare Proxied for WAF rules, make sure your SSL/TLS encryption mode is set to Full (Strict) and turn off Always Use HTTPS until HighLevel finishes issuing the cert.

For edge routing specifics, refer to the HighLevel Knowledge Base and the Cloudflare DNS documentation.

Step 3: Add the Domain in GoHighLevel Agency Settings

Once your DNS record is saved, map the domain in your HighLevel agency dashboard:

1. Switch to Agency View in the left sidebar.
2. Click Settings at the bottom.
3. Select Company.
4. Scroll to the Whitelabel Domain (or Agency Domain) input.
5. Enter your subdomain (e.g., app.youragency.com). Don’t include https:// or trailing slashes.
6. Click Save Company Settings.

HighLevel will fire off a background job to verify the CNAME and request a Let’s Encrypt certificate. This usually takes anywhere from 60 seconds to 10 minutes depending on DNS propagation.

Step 4: Verify DNS and SSL with the Terminal

Don’t refresh your browser over and over. Check propagation directly from your terminal with dig and curl.

First, verify your subdomain resolves to the CNAME target:

dig +short CNAME app.youragency.com

You should see something like this:

app.msgsndr.com.

Next, test the TLS handshake with curl to confirm the edge server serves the cert without handshake failures:

curl -Iv https://app.youragency.com 2>&1 | grep -E "(HTTP/|SSL certificate verify|Server:)"

You should get a HTTP/2 200 or HTTP/1.1 200 OK response with clean SSL verification details. If you get a certificate error (SSL certificate problem or a mismatch showing a generic cloud domain), give the background provisioning another 10–15 minutes.

Step 5: Brand the Whitelabel Login Screen

Now that the domain resolves, strip out the default HighLevel assets. In Agency View > Settings > Company, configure your branding:

• Agency Logo: Upload a high-res transparent PNG or SVG (400x120px works best). It appears on the login card and in the top-left corner of the app once logged in.
• Favicon: Upload a 32x32px or 64x64px PNG/ICO file for browser tabs.
• App Title: Set the title string displayed in the browser tab (e.g., GrowthOS - Agency Platform).

To tweak the login page layout further, you can paste custom CSS into the Custom CSS field in Agency Settings. Here’s a snippet to clean up the login container and soften the corners:

/* Custom styling for whitelabel login card */
.hl-login-container { border-radius: 12px; box-shadow: 0 10px 30px rgba(0, 0, 0, 0.08); border: 1px solid rgba(229, 231, 235, 1);
} .hl-login-container button.btn-primary { border-radius: 8px; font-weight: 600; letter-spacing: 0.02em;
}

Step 6: Update Sub-Account Snapshots and Notification Links

Your custom portal is live, but hardcoded URLs in old emails or workflows will still point to the default HighLevel domain if you’re not careful.

Audit these areas:

1. User Invitation Emails: New invite emails sent via Settings > My Staff automatically use your new domain.
2. Workflow Notifications: If you built workflows that send login links, make sure you use dynamic custom values instead of hardcoded URLs. If you push updates across sub-accounts, see how to update GoHighLevel snapshots without overwriting assets to avoid clobbering those values.
3. Webhook Routing: If third-party tools build login redirect URLs, update them to your new domain. If you need to map accounts via API, check our guide on how to find sub-account Location ID in GoHighLevel.

Troubleshooting Common Whitelabel Errors

1. Domain Shows HighLevel 404 “Page Not Found”

This means your CNAME record is resolving to app.msgsndr.com, but the domain hasn’t been saved under Agency Settings > Company. HighLevel’s reverse proxy receives the request with the Host: app.youragency.com header, finds no agency matching that host in its database, and returns a generic 404. Check for typos in your Agency Settings.

2. ERR_TOO_MANY_REDIRECTS

This almost always means Cloudflare is set to Flexible SSL. In Flexible mode, Cloudflare hits HighLevel on plain HTTP (port 80). HighLevel replies with a 301 redirect to HTTPS (port 443). Cloudflare catches that, requests port 80 again, and you’re stuck in an infinite redirect loop. Switch Cloudflare SSL to Full or disable the proxy (Grey Cloud).

3. Mobile PWA App Name Still Shows Default

HighLevel lets users install the dashboard as a PWA on iOS and Android. To replace the default name and splash icon, head to Agency Settings > Company > White Label Mobile App and set your PWA display name and mobile icon manually.

Frequently Asked Questions

Can I use my root domain as my whitelabel portal?

No. HighLevel requires a CNAME record for the whitelabel portal. Most DNS providers won’t let you set a CNAME on root apex domains (youragency.com) without breaking apex MX records needed for receiving email. Stick to a subdomain like app.youragency.com.

How long does SSL provisioning take?

Usually 5 to 15 minutes once the CNAME resolves. If your browser still flags an SSL error after 30 minutes, delete the domain in Agency Settings, wait 2 minutes, add it back, and hit Save to trigger a fresh Let’s Encrypt challenge.

Will my clients see GoHighLevel anywhere after whitelabeling?

With the portal domain, custom logo, favicon, and a dedicated email sending domain set up, HighLevel branding is hidden across the main interface. Just remember to check external integrations like Stripe customer receipts or Twilio opt-out templates so your agency branding stays consistent everywhere.

Do I need a separate whitelabel domain for each sub-account?

No. A single agency whitelabel domain (e.g., app.youragency.com) handles all your sub-accounts. When users authenticate, HighLevel routes them to their assigned sub-account based on user permissions.

Next Steps

With your portal live and secured, the next priority is email deliverability so notifications don’t land in spam. Check out our step-by-step guide to setting up a dedicated email sending domain in GoHighLevel to configure your SPF, DKIM, and DMARC records.