Set Up an Email Sending Subdomain in GoHighLevel with Cloudflare

Sending marketing emails from your apex domain is a fast way to get your primary Google Workspace or Microsoft 365 inbox blacklisted. One bad campaign or a spike in spam complaints, and suddenly your direct client emails land in the spam folder. The fix is simple: set up a dedicated sending subdomain inside GoHighLevel using Cloudflare DNS to isolate your sender reputation while keeping full SPF, DKIM, and DMARC alignment.

I set these up frequently for client sub-accounts on LeadConnector (LC) Email. If you miss one specific Cloudflare toggle, verification will fail silently for hours. Here is the exact walkthrough, the DNS values you need, and how to get everything verified in under five minutes.

Why You Should Always Use a Subdomain for LC Email

Firing bulk campaigns straight from your root domain (example.com) is asking for trouble. If cold outreach or an unengaged list triggers spam flags, your everyday business communication takes the hit.

Using a subdomain like mg.example.com, mail.example.com, or replies.example.com isolates that risk. GoHighLevel’s LC Email engine manages delivery, bounces, and unsubscriptions on that subdomain, leaving your root MX records and day-to-day corporate inbox completely untouched.

If you’ve already walked through setting up a dedicated email sending domain in GoHighLevel, setting up a subdomain uses the exact same authentication stack—you just need to pay attention to your record prefixes in Cloudflare.

Step 1: Add the Subdomain in GoHighLevel

First, generate the DNS record values from HighLevel. You can do this at the agency level or within an individual sub-account.

1. Log in to your HighLevel dashboard.
2. Head to Settings > Email Services > Dedicated Domain.
3. Click Add Domain.
4. Type in your subdomain (for example, mg.yourdomain.com).
5. Click Save & Continue.

HighLevel will give you five DNS records to add: two TXT records, one CNAME, and two MX records.

Step 2: Understanding the 5 DNS Records

Here is what each record actually handles behind the scenes:

• TXT (SPF): Tells recipient servers that Mailgun/LeadConnector is authorized to send emails for your subdomain.
• TXT (DKIM): Provides a public cryptographic key (usually under k1._domainkey.subdomain) to verify that outgoing emails weren’t tampered with in transit.
• CNAME: Rewrites tracking links and open pixels to your custom domain so you don’t leak generic third-party tracking hostnames.
• MX Records (2x): Points inbound replies back to HighLevel’s conversation inbox at priority 10.

For a deeper dive into these records, check out our guide on how to configure and verify DNS records for GoHighLevel email or consult the official GoHighLevel Support Documentation.

Step 3: Add the Records to Cloudflare DNS

Open your Cloudflare dashboard, select your domain zone, and navigate to the DNS tab. Click Add record for each entry HighLevel gave you.

1. The SPF Record (TXT)

Choose TXT, set the Name to your subdomain prefix (e.g., mg), and paste the SPF string into Content.

Your SPF record configuration should look like this:

Type: TXT
Name: mg
Content: v=spf1 include:mailgun.org ~all
TTL: Auto

2. The DKIM Record (TXT)

Select TXT. For the Name, enter the selector prefix. Watch out here: if HighLevel shows k1._domainkey.mg.yourdomain.com, Cloudflare automatically appends your apex domain, so you only need to enter k1._domainkey.mg.

Type: TXT
Name: k1._domainkey.mg
Content: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC...
TTL: Auto

3. The Tracking Record (CNAME)

Choose CNAME, enter email.mg for the Name, and point the Target to mailgun.org.

Type: CNAME
Name: email.mg
Target: mailgun.org
Proxy status: DNS only (Gray Cloud)
TTL: Auto

4. The MX Records

Add both MX records so replies from leads route directly into the HighLevel conversation tab.

Record 1:
Type: MX
Name: mg
Mail server: mxa.mailgun.org
Priority: 10 Record 2:
Type: MX
Name: mg
Mail server: mxb.mailgun.org
Priority: 10

The Cloudflare Gotcha: Disable the Orange Cloud Proxy

This is the number one reason HighLevel DNS checks fail on Cloudflare: Proxy status is enabled.

Cloudflare defaults to turning on its orange-cloud proxy for CNAME records. But HighLevel’s verification tool expects direct DNS resolution for email.mg.yourdomain.com. If Cloudflare’s HTTP proxy intercepts the query, HighLevel can’t verify the record and leaves it stuck on red.

• Make sure the Proxy status on your CNAME record is toggled to DNS only (Gray Cloud).
• MX and TXT records are always DNS-only in Cloudflare by default.

If you also host client portals, take a look at our whitelabel domain GoHighLevel web app setup guide, where proxy settings and SSL certificates behave a bit differently.

Step 4: Verify Records in HighLevel

Once all five records are saved in Cloudflare, jump back to HighLevel and click Verify Domain.

Cloudflare pushes DNS updates globally in seconds. You should see green checkmarks across SPF, DKIM, MX, and CNAME almost immediately.

If a record fails, check the hostname field in Cloudflare. The most common mistake is pasting the full domain into Cloudflare (e.g., k1._domainkey.mg.yourdomain.com), which causes Cloudflare to resolve it as k1._domainkey.mg.yourdomain.com.yourdomain.com. Strip off your root domain from the prefix and re-verify.

Step 5: Testing Outbound Delivery and Inbox Headers

Never assume your setup is complete until you look at raw email headers. Trigger a test email from HighLevel to your personal inbox or run it through a tool like Mail-Tester.

In Gmail, click the three vertical dots on the email and select Show original. Verify that both SPF and DKIM show PASS with your subdomain listed:

SPF: PASS with IP 198.61.254.x (mg.yourdomain.com)
DKIM: 'PASS' with domain mg.yourdomain.com
DMARC: 'PASS'

If you’re building automated campaigns, remember that missing contact attributes can break your copy. Read our tutorial on how to set fallback default values for merge fields in GoHighLevel to prevent awkward blank spaces in your templates.

Optional: Adding a Subdomain DMARC Policy

If your root domain already has a DMARC policy (at _dmarc.yourdomain.com), your subdomain inherits it by default per the DMARC.org Specification.

However, if you want a distinct DMARC policy specifically for this subdomain, you can add an explicit TXT record in Cloudflare:

Type: TXT
Name: _dmarc.mg
Content: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
TTL: Auto

Using p=none lets you collect delivery reports without risking accidental bounces while warming up the new subdomain.

Frequently Asked Questions

Can I use the root domain instead of a subdomain in GoHighLevel?

You can, but it is rarely a good idea if you rely on Google Workspace or Microsoft 365. Adding HighLevel MX records at the root can break inbound routing for your standard corporate mailboxes. A subdomain keeps everything isolated and safe.

How long does Cloudflare DNS propagation take for HighLevel?

Cloudflare usually propagates updates in under 30 seconds. If HighLevel isn’t verifying, check that your CNAME is set to DNS only (gray cloud) and confirm you didn’t accidentally duplicate your apex domain in the record names.

Do I need to buy a separate domain for LC Email?

No. You can spin up as many subdomains as you want (like send.yourbrand.com or mail.yourbrand.com) inside your existing Cloudflare account for free.

What happens to inbound replies sent to the subdomain?

Because the two MX records point to mxa.mailgun.org and mxb.mailgun.org, HighLevel captures replies automatically and attaches them to the contact record under the Conversations tab.

Next Steps for Your HighLevel Setup

With SPF and DKIM verified on your subdomain, your outbound email reputation is isolated and ready for production. From here, take a look at how to set up SMS quiet hours and sending windows in GoHighLevel workflows so your automated sequences don’t trigger compliance issues during off-hours.