GoHighLevel Email Deliverability: Mailgun Setup, Domain Authentication and Staying Out of Spam (2026)

Every week I audit GoHighLevel sub-accounts where the campaigns are well built, the copy is decent, and the open rates still sit under 10 per cent. The owner assumes the problem is the subject line. Nine times out of ten it is not. The emails are landing in spam or the Promotions tab because the sending domain was never properly authenticated, the list is full of cold contacts, and nobody has looked at a bounce report since the account was set up. Deliverability is plumbing, not copywriting, and in 2026 the plumbing rules are stricter than they have ever been.

Since Gmail and Yahoo rolled out their bulk-sender requirements, senders pushing more than roughly 5,000 emails a day to those inboxes must have SPF, DKIM and DMARC in place, must offer one-click unsubscribe, and must keep their spam complaint rate under 0.3 per cent. Miss any of those and your mail gets throttled or binned regardless of how good the offer is. This guide walks through exactly how to set up GoHighLevel email deliverability the right way: choosing between LC Email and a dedicated Mailgun domain, publishing the correct DNS records, warming the domain, and building the workflows that keep your list clean long after launch day.

Why GoHighLevel emails land in spam

GHL itself does not cause spam placement. What causes it is the combination of factors that mailbox providers score every message against: the reputation of the sending domain and IP, whether authentication passes, how recipients engage, and how many of them complain. Most spam-folder problems I see in Australian sub-accounts trace back to one of four causes.

First, the account is sending from the shared LC Email pool without a verified dedicated domain, so its reputation is tied to thousands of other senders. Second, the DNS records were half done — SPF exists but DKIM was never verified, or DMARC is missing entirely, which now fails Gmail's bulk-sender check outright. Third, the list includes contacts imported from an old CRM who have not opened anything in eighteen months; mailing them tanks engagement metrics and triggers spam-trap hits. Fourth, the domain went from zero to 10,000 sends on day one with no warm-up, which looks exactly like what a spammer does.

The good news is that all four are fixable inside GHL with DNS access and a couple of workflows. None of it requires third-party tools, although Google Postmaster Tools (which is free) should be part of your monitoring stack.

LC Email vs a dedicated Mailgun domain

GoHighLevel gives you two sending options. LC Email (LeadConnector Email) is the built-in system: it runs on HighLevel's own Mailgun infrastructure, is enabled by default on new sub-accounts, and lets you verify a dedicated sending domain under Settings → Email Services. The alternative is connecting your own Mailgun account with your own API key and a dedicated domain you control end to end.

When LC Email is enough

For most agencies and small businesses, LC Email with a verified dedicated domain is the right answer. You get per-domain reputation, automatic DNS record generation, and billing rolled into your HighLevel usage. There is no separate Mailgun subscription to manage, and the dedicated domain setup takes about twenty minutes if you have DNS access. The critical step people skip: LC Email without a verified domain sends from a shared pool. Always verify your own subdomain.

When to bring your own Mailgun account

Connect your own Mailgun account when you send high volume (say 50,000-plus emails a month per sub-account), need dedicated IP addresses, want direct access to Mailgun's suppression lists and logs, or run a SaaS-mode agency where clients demand infrastructure isolation. You will pay Mailgun directly and manage the account yourself, but you gain full control over IP warm-up and reputation. Either way, the DNS work described below is identical.

One structural rule regardless of provider: never send marketing email from your root domain. Use a subdomain such as mail.yourbusiness.com.au or em.yourbusiness.com.au. If the subdomain's reputation is ever damaged, your primary domain — and the transactional email your business runs on — stays protected.

Step-by-step domain authentication: SPF, DKIM and DMARC

Authentication tells Gmail, Outlook and Yahoo that you are who you claim to be. Here is the sequence I use on every sub-account.

Step 1: Add your dedicated domain in GHL

Go to Settings → Email Services → Dedicated Domain (or your Mailgun dashboard if you connected your own account) and add your sending subdomain. GHL generates the exact DNS records you need — usually two TXT records (SPF and DKIM), a CNAME for click and open tracking, and MX records so bounces route back correctly.

Step 2: Publish the records in DNS

Log in to wherever your DNS lives — commonly Cloudflare, VentraIP or Crazy Domains for Australian businesses — and add each record exactly as generated. If you use Cloudflare, set the tracking CNAME to DNS-only (grey cloud), not proxied, or verification will fail. Two things trip people up: SPF allows only one TXT record per host, so if one already exists you merge the include statement into it rather than adding a second record; and DKIM values are long strings that some registrars silently truncate — paste carefully and check.

Step 3: Add a DMARC record

GHL will not always generate DMARC for you, but Gmail and Yahoo now require it for bulk senders. Add a TXT record at _dmarc.yourdomain.com.au with at minimum v=DMARC1; p=none; rua=mailto:[email protected]. Start at p=none to collect reports without affecting delivery, then tighten to p=quarantine once you have confirmed a few weeks of clean reports. The rua address receives aggregate reports showing who is sending as your domain — worth reading, because you will occasionally find a forgotten tool still mailing on your behalf.

Step 4: Verify and test

Back in GHL, hit verify. Then send a test email to a Gmail address, open it, choose Show Original, and confirm you see SPF: PASS, DKIM: PASS and DMARC: PASS. Free checkers like MXToolbox or a mail-tester score are useful, but the Show Original headers are the ground truth.

Here are the records at a glance:

Warming up a new sending domain

A freshly verified domain has no reputation, and inbox providers treat no reputation as suspicion. If you blast your full list in week one, you will be filtered before you have a history to stand on. Warm up over three to four weeks instead.

Week one, send 50 to 100 emails a day to your most engaged segment — recent customers, people who replied in the last 30 days. Week two, roughly double to 200 to 500 a day. Week three, move to 1,000 to 2,000. Week four onward, ramp to full volume, watching bounce and complaint metrics at each step. The easiest way to control this in GHL is batch scheduling in campaigns, or a Workflow with a wait step and a trigger that drip-releases contacts tagged by engagement tier. Build the tiers with tags like engaged-30d, engaged-90d and cold, and warm up from hottest to coldest. If you already run automations, this slots neatly alongside your existing GoHighLevel AI workflows — the same trigger logic that routes leads can throttle sends.

During warm-up, prioritise emails that get replies. A reply is the strongest positive signal a mailbox provider sees. Plain-text check-in emails from the owner outperform designed newsletters for reputation-building every time.

List hygiene and engagement: sunset the cold contacts

Authentication gets you to the door; engagement keeps you inside. Gmail's filters weight how your recipients behave — opens, replies, deletes-without-reading, spam reports — so mailing people who ignore you actively damages delivery to people who want you.

Build a sunset workflow in every sub-account. Mine works like this: a Workflow trigger fires when a contact reaches 90 days with no email engagement (tracked via a custom field updated on open/click, or via GHL's engagement conditions). The contact gets tagged re-engage and enters a three-email win-back sequence over two weeks. Anyone who opens or clicks gets the tag swapped to engaged-30d and returns to normal sends. Anyone who does not gets tagged suppressed-cold and is excluded from all marketing campaigns via a smart list filter. You are not deleting them — SMS or a Conversation AI follow-up on another channel can still revive them, especially if you have your SMS and A2P compliance sorted — but they stop dragging your email metrics down.

Two more hygiene rules. Never import a purchased or scraped list; one spam-trap address can quarantine a domain for months. And honour the Gmail/Yahoo one-click unsubscribe requirement — GHL adds the List-Unsubscribe header automatically on marketing sends, but make sure your templates also carry a visible unsubscribe link and that you are not suppressing it in custom HTML templates.

Monitoring: the numbers that actually matter

Deliverability is not set-and-forget. Check three dashboards on a fortnightly rhythm.

Inside GHL, the Email Statistics view per sub-account shows delivered, opened, clicked, bounced and complained. Keep hard bounces under 2 per cent — above that, your list needs cleaning before your reputation pays for it. Complaint rate must stay under 0.1 per cent as a working target; the Gmail enforcement threshold is 0.3 per cent, and once you cross it recovery takes months, not days.

Outside GHL, set up Google Postmaster Tools for your sending domain. It shows your domain and IP reputation as Gmail sees it, spam-rate trends, and authentication pass rates — data you cannot get anywhere else. If reputation drops from High to Medium, pause volume and investigate before it hits Low. Your DMARC aggregate reports round out the picture by revealing any unauthorised senders. If open rates have quietly slid over months and you are not sure where the leak is, a structured GoHighLevel health check across email settings, workflows and pipeline data usually finds it faster than guessing.

Common mistakes to avoid

• Sending from the shared LC Email pool without verifying a dedicated sending domain, so your reputation is hostage to strangers.
• Using your root domain for marketing email instead of a subdomain, putting your day-to-day business email at risk.
• Skipping DMARC because GHL verified the domain without it — Gmail and Yahoo bulk-sender rules now require it.
• Blasting the full list on day one with no warm-up schedule, which gets a new domain filtered within a week.
• Importing old or purchased lists and mailing contacts who have not engaged in over a year, inviting spam-trap hits and complaints.
• Never checking bounce rates, complaint rates or Google Postmaster Tools until open rates have already collapsed.

If you want your GoHighLevel emails authenticated, warmed up and landing in the inbox instead of spam, book a strategy call with the HL Growth Partner team.

Book Your Strategy Call →

Frequently asked questions

Do I need my own Mailgun account, or is LC Email enough?

For most sub-accounts, LC Email with a verified dedicated sending domain is enough — you get per-domain reputation without a separate subscription. Bring your own Mailgun account when you need dedicated IPs, very high volume, direct suppression-list access, or infrastructure isolation for SaaS-mode clients.

How long does it take to warm up a new sending domain?

Plan on three to four weeks. Start at 50 to 100 emails a day to your most engaged contacts, roughly double the volume each week, and only ramp to full volume once bounce rates stay under 2 per cent and complaints stay near zero throughout the ramp.

What spam complaint rate do Gmail and Yahoo allow?

The enforcement threshold is 0.3 per cent, but you should treat 0.1 per cent as your working ceiling. Sustained rates near 0.3 per cent trigger filtering or outright rejection, and recovering a damaged domain reputation typically takes months of reduced, high-engagement sending.

Why do my GHL emails pass SPF and DKIM but still land in spam?

Authentication is necessary but not sufficient. If your list is full of cold contacts, your engagement metrics are poor, or your domain is new with no reputation, Gmail will still filter you. Fix list hygiene, run a sunset workflow, and warm the domain — then authentication can do its job.

Should marketing emails come from my main business domain?

No. Always send bulk and marketing email from a dedicated subdomain such as mail.yourbusiness.com.au. That isolates the marketing reputation from your root domain, so a bad campaign never jeopardises the transactional and one-to-one email your business depends on.