Set Up a Dedicated Email Sending Domain in GoHighLevel (LC Email)

If you send emails through GoHighLevel without setting up a dedicated sending domain, your messages get lumped into shared LC Email (LeadConnector) IP pools. That means your deliverability is directly tied to whatever shady affiliate list another agency on that shared pool decided to blast five minutes ago.

Here is how to set up your own dedicated email sending domain in GoHighLevel using native LC Email. We’ll wire up the required DNS records (SPF, DKIM, MX, CNAME, and DMARC), dodge the usual Cloudflare proxy traps that break verification, and test authentication right from the command line.

Why Shared Pools Kill Deliverability (and Why You Need a Dedicated Domain)

By default, new GoHighLevel sub-accounts route through a shared LeadConnector pool. If you send an email from info@yourcompany.com without your own DNS authentication, receiving mail servers look at the headers and see a glaring mismatch: the From: address says your domain, but the Return-Path: and DKIM signatures point back to a shared LeadConnector hostname.

Under Google and Yahoo’s Email Sender Guidelines, unaligned sender addresses get flagged fast. Skip your dedicated domain setup and you’ll run into high bounce rates, spam folder placement, and temporary 421 4.7.0 rate-limiting errors.

A dedicated domain fixes three key things:

• SPF Alignment: Authorizes LC Email servers to send on behalf of your domain.
• DKIM Signatures: Signs your outbound messages with your own cryptographic key.
• Custom Return-Path & Tracking: Routes bounce handling and click tracking through your own branded hostname instead of generic LeadConnector URLs.

Root Domain vs Subdomain: The Architecture Decision

Do not use your root apex domain (like example.com) as your dedicated sending domain in LC Email if you already run Google Workspace, Microsoft 365, or Fastmail on it. Doing that creates conflicting MX records and can completely break your normal business inbox.

HighLevel needs two MX records for LC Email so it can catch replies and parse unsubscribes inside the Conversations tab. If your DNS provider doesn’t handle split MX priorities cleanly, LC Email’s MX records will fight your Google Workspace MX records.

Use a dedicated sending subdomain instead. These are the most common patterns:

• mg.yourdomain.com (Standard mail gateway prefix)
• send.yourdomain.com (Clean and descriptive for outbound & transactional mail)
• mail.yourdomain.com (Traditional sending prefix)
• replies.yourdomain.com (Great for sales cadences)

When you send an email from john@yourdomain.com inside HighLevel with send.yourdomain.com set up as your dedicated domain, LC Email handles the envelope sender (SPF/DKIM) on the subdomain while keeping your friendly From address clean. Much like setting up subdomains for websites and funnels, subdomains keep your core infrastructure safely isolated.

Step 1: Add Your Dedicated Domain in HighLevel Settings

You can configure dedicated domains at the Agency level (Agency Settings → Email Services) or the Sub-Account level (Sub-Account Settings → Email Services → Dedicated Domain). For client accounts with their own branding, configure it inside the specific Sub-Account.

1. Open your HighLevel Sub-Account dashboard.
2. Click Settings at the bottom of the left sidebar.
3. Head to Email Services → Dedicated Domain.
4. Click Add Domain.
5. Type in your subdomain (for example: send.yourdomain.com).
6. Click Add & Verify.

HighLevel will spit out a table of 5 DNS records that you need to add to your DNS provider (Cloudflare, GoDaddy, Namecheap, Route53, etc.). Keep this modal open while you work in your DNS dashboard.

Step 2: Configure the 5 DNS Records (SPF, DKIM, MX, CNAME, DMARC)

You need five distinct records in your DNS manager. Here is the exact breakdown of what HighLevel expects for LC Email.

1. TXT Record for SPF (Sender Policy Framework)

Tells receiving servers that LC Email is authorized to send mail for your subdomain.

• Type: TXT
• Name / Host: send (or send.yourdomain.com depending on your DNS host’s format)
• Value: v=spf1 include:mailgun.org ~all (or whatever include:leadconnector.com string your modal shows)
• TTL: Auto or 300 seconds

2. TXT Record for DKIM (DomainKeys Identified Mail)

Contains the public key used to verify message integrity.

• Type: TXT
• Name / Host: k1._domainkey.send
• Value: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC... (copy the full string directly from HighLevel)
• TTL: Auto or 300 seconds

3. MX Records for Reply Handling

HighLevel provides two MX records. You need both so inbound replies route back into your HighLevel Conversations tab.

• Record 1: Type: MX | Host: send | Value: mxa.mailgun.org (or mxa.leadconnectorhq.com) | Priority: 10
• Record 2: Type: MX | Host: send | Value: mxb.mailgun.org (or mxb.leadconnectorhq.com) | Priority: 10

4. CNAME Record for Link & Open Tracking

Rewires tracking pixels and wrapped links through your domain instead of generic hostnames.

• Type: CNAME
• Name / Host: email.send
• Value: mailgun.org (or leadconnectorhq.com)
• TTL: Auto or 300 seconds

5. TXT Record for DMARC

HighLevel’s basic verification table sometimes skips mentioning DMARC, but inbox providers will flat out drop or spam-bin unauthenticated mail without an explicit DMARC policy on your apex domain.

Add this to your root domain (apex) if you haven’t already:

• Type: TXT
• Name / Host: _dmarc (resolves to _dmarc.yourdomain.com)
• Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; sp=none; aspf=r;
• TTL: Auto or 300 seconds

If you’re managing this in Cloudflare and want a full walkthrough, check our guide on connecting Cloudflare custom domains to HighLevel.

Step 3: Handle Cloudflare Proxy and DNS Propagation Traps

The single most common reason LC Email verification fails is Cloudflare’s proxy switch. When the orange cloud icon is turned ON (Proxied) for your CNAME record, Cloudflare intercepts the traffic with its HTTP proxy and SSL certificate instead of returning the raw CNAME target.

HighLevel’s verification bot hits the Cloudflare proxy IP instead of the actual mail target and instantly flags the CNAME as failed.

Here is how your Cloudflare DNS table should look for this subdomain:

# DNS Records for LC Email Subdomain (send.yourdomain.com)
Type: TXT | Name: send | Content: v=spf1 include:mailgun.org ~all | Proxy: DNS Only
Type: TXT | Name: k1._domainkey.send| Content: k=rsa;
p=MIGfMA0G... | Proxy: DNS Only
Type: MX | Name: send | Content: mxa.mailgun.org (Priority 10) | Proxy: DNS Only
Type: MX | Name: send | Content: mxb.mailgun.org (Priority 10) | Proxy: DNS Only
Type: CNAME | Name: email.send | Content: mailgun.org | Proxy: DNS Only (Grey Cloud!)
Type: TXT | Name: _dmarc | Content: v=DMARC1;
p=none;
| Proxy: DNS Only

Make sure the CNAME for email.send is set to DNS Only (Grey Cloud). If you hit strange domain errors elsewhere in your funnels, take a look at how to fix domain SSL pending and DNS errors in GoHighLevel.

Step 4: Verify Domain Status and Fix Verification Failures

Once you’ve saved all records in your DNS manager, hop back to HighLevel and click Verify Domain.

When everything resolves, you’ll get green checkmarks across all five rows (SPF, DKIM, MX 1, MX 2, CNAME), and the domain status badge switches from yellow Pending to green Active.

If any row gives you a red X, check these common culprits:

1. Double Subdomain Typos: Providers like Namecheap and GoDaddy append your root domain automatically. If you type k1._domainkey.send.yourdomain.com into the host field, you’ll end up with k1._domainkey.send.yourdomain.com.yourdomain.com. In those dashboards, enter just k1._domainkey.send.
2. DKIM Truncation: 2048-bit DKIM keys exceed the 255-character single-string limit in older DNS UIs. Make sure your provider wraps long TXT records in quotes without stripping characters.
3. TTL Caching: If your TTL was set high (like 86400 / 24 hours), negative DNS caches take a while to clear. Drop your TTL to 300 seconds (5 minutes) while testing.

You can also reference setup parameters in the HighLevel Help Center under Email Services.

Step 5: Test Deliverability and Verify DKIM/SPF Alignment with Dig

Don’t guess whether DNS updated. Query Google’s public resolver (8.8.8.8) directly with dig or nslookup from your terminal.

Here is what I run to check every record in seconds:

# 1. Check TXT records (SPF and DMARC)
dig @8.8.8.8 TXT send.yourdomain.com +short
dig @8.8.8.8 TXT _dmarc.yourdomain.com +short # 2. Check DKIM Public Key
dig @8.8.8.8 TXT k1._domainkey.send.yourdomain.com +short # 3. Check MX Records
dig @8.8.8.8 MX send.yourdomain.com +short # 4. Check CNAME Tracking
dig @8.8.8.8 CNAME email.send.yourdomain.com +short

You should see your exact Mailgun or LeadConnector values in the response. If DKIM returns empty, your host hasn’t published the TXT record yet.

Next, send a live test email from a workflow to an inspection tool like MXToolbox SuperTool or a test Gmail account. In Gmail, click the three dots on the email and select Show original.

Make sure all three checks pass:

• SPF: PASS with IP [LC Server IP]
• DKIM: 'PASS' with domain send.yourdomain.com
• DMARC: 'PASS'

With authentication dialed in, you can safely test custom variables in your templates. See our guide on how to insert and test merge fields in GoHighLevel email templates so dynamic tags don’t break before launching real campaigns.

Setting Default Sender Address and Replying Routing

Once your dedicated domain shows as Active, set it as the default sending domain for the location. Head to Settings → Email Services → Dedicated Domain, click the three dots next to your verified subdomain, and select Set as Default.

Now, whenever an email workflow runs with an empty From Email field, HighLevel defaults to this domain. In your workflow settings, keep your sender info consistent:

• From Name: Fahim from isitdev
• From Email: fahim@send.yourdomain.com (or fahim@yourdomain.com as your friendly alias)

When someone hits reply, their mail client sends the message back to the subdomain’s MX host (mxa.mailgun.org / leadconnectorhq.com), which dumps it straight into GoHighLevel’s Conversations tab. If you run a whitelabel agency setup, make sure your custom whitelabel domain aligns with your domain structure for a clean, consistent setup.

Frequently Asked Questions

Can I use my main apex domain (example.com) for LC Email?

Technically yes, but don’t do it. If you use Google Workspace or Microsoft 365 on example.com, adding HighLevel’s MX records to the apex domain can route your everyday business emails into GoHighLevel or break inbound delivery entirely. Always use a subdomain like send.example.com.

How long does LC Email DNS verification take?

On Cloudflare or Route53 with low TTLs, it usually verifies in under 60 seconds. On slower shared registrars (like standard GoDaddy or Bluehost DNS), it can take anywhere from 15 minutes to a few hours. You can mash the Verify Domain button without breaking anything.

Do I need to warm up a new dedicated sending domain?

Yes. If your subdomain has never sent volume before, inbox providers will throttle sudden blasts of 5,000 emails on day one. Start with transactional workflow notifications and high-engagement welcome emails (50–100/day), scaling volume by ~20% every few days over 2 to 4 weeks.

Why does my email show “via leadconnectorhq.com” in Gmail?

That warning shows up when the From: domain doesn’t match the DKIM signing domain. Once your dedicated domain is verified, set as default, and aligned with your DMARC policy, the “via” warning goes away completely.

Next Steps for Email Deliverability

With your dedicated sending domain active and passing SPF/DKIM/DMARC checks, review your outbound automations. Clean out bad addresses before blasting, set up default fallback values for custom merge fields so leads never see blank tags, and keep bounce rates low to protect your new domain’s sender reputation.