Email Deliverability for HighLevel Agencies: DMARC, DKIM and SPF Without the Headache

A client calls: "Nobody's opening our emails." You check the campaign. The subject line is fine, the copy is fine and the offer is good. The real problem is that most of the emails never reached the inbox. They went to spam, or Gmail quietly rejected them.

When client campaigns land in spam, it's usually a DNS problem, not a copy problem. Gmail, Yahoo and Outlook now spell out exactly what senders need. This guide explains those rules in plain words and shows how to set up a HighLevel sub-account so client emails actually arrive.

Disclosure: I'm a HighLevel affiliate. Links to HighLevel in this post are affiliate links. I may earn a commission if you sign up through them, at no extra cost to you.

TLDR

• Most spam-folder problems come from missing or misaligned SPF, DKIM and DMARC records, or from sending to old, unengaged lists.
• Gmail and Yahoo require bulk senders to authenticate with SPF and DKIM, publish a DMARC record (at least p=none), offer one-click unsubscribe and keep spam complaints low. Outlook added similar rules for high-volume senders in May 2025.
• In HighLevel, set up a dedicated sending domain for each client, usually a subdomain like replies.clientdomain.com, under Settings > Email Services.
• Start DMARC at p=none, read the reports and only move to quarantine once every legitimate sender passes.
• Warm up new domains slowly and keep lists clean. Authentication gets you in the door. Engagement keeps you there.

Why Do Client Emails Land in Spam?

Mailbox providers decide where an email goes based on two questions: can they verify who sent it, and do recipients want it?

• Authentication fails. The email claims to be from client.com, but nothing in client.com's DNS says HighLevel is allowed to send for it. That's what SPF, DKIM and DMARC fix.
• Shared sending reputation. Without a dedicated domain, a client's emails ride on a shared reputation they can't control.
• Bad lists. Old imports, purchased lists and contacts who never opened anything drive bounces and spam complaints.
• Sudden volume. A brand-new domain that sends 20,000 emails on day one looks like a spammer.

The three records in plain words:

• SPF: a list of the servers allowed to send email for your domain.
• DKIM: a digital signature on each email that proves it wasn't altered and really came from your domain.
• DMARC: a policy that tells inboxes what to do when an email fails SPF and DKIM, and sends you reports about who's sending as your domain.

What Do Gmail, Yahoo and Outlook Require From Bulk Senders?

Gmail

Google's sender guidelines apply extra rules to anyone sending 5,000 or more messages a day to personal Gmail accounts:

• Authenticate with both SPF and DKIM.
• Publish a DMARC record. A policy of p=none is the minimum.
• The From: domain must align with either the SPF or the DKIM domain.
• Marketing emails need one-click unsubscribe, and unsubscribe requests must be honored within 48 hours.
• Keep the user-reported spam rate below 0.1% and never let it reach 0.3%.

Yahoo

Yahoo's sender best practices are similar: use both SPF and DKIM, publish a valid DMARC policy of at least p=none that passes, support one-click unsubscribe, honor unsubscribes within two days and keep the spam rate below 0.3%. Yahoo doesn't publish a volume threshold, so treat these as rules for everyone.

Outlook

Microsoft announced that from May 5, 2025, Outlook.com would route mail from high-volume domains (over 5,000 messages a day) that don't pass SPF, DKIM and DMARC to the Junk folder, with outright rejection to follow (Petri).

The takeaway for agencies: every client that sends marketing email from HighLevel should have SPF, DKIM and DMARC set up, whatever their volume today.

Setting Up a Dedicated Sending Domain in HighLevel

HighLevel's dedicated sending domain guide covers the steps. In short:

1. Pick a subdomain. Use something like replies.clientdomain.com rather than the root domain. If the client uses Google Workspace or Microsoft 365 for their normal email, a subdomain avoids clashing with their existing MX records.
2. Add it in HighLevel. In the client's sub-account, go to Settings > Email Services > Dedicated Domain and click Add Domain.
3. Add the DNS records HighLevel shows you. Typically an SPF record, a DKIM record, two MX records and a tracking CNAME. Copy the values from the client's own screen, since the DKIM value is unique to each domain.
4. Verify. Click Verify Domain. DNS can take a few minutes to update, so retry if it's not green right away.
5. Send from a matching address. Use a From: address on the same domain, like hello@clientdomain.com, so it aligns with the authentication.

HighLevel's setup doesn't add a DMARC record for you. Add it separately at the client's DNS host, as a TXT record on _dmarc.clientdomain.com. A starting record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@clientdomain.com

If you run HighLevel as a white-label platform, add this to your client onboarding checklist, right next to the texting setup in our A2P 10DLC guide.

Moving DMARC From Monitor to Quarantine Without Breaking Anything

p=none only monitors. It doesn't stop anyone from spoofing the client's domain. The goal is to move to p=quarantine, and eventually p=reject, without blocking the client's real email.

1. Start at p=none with reports. The rua address receives daily reports showing every service sending as the domain.
2. Review two to four weeks of reports. Use a DMARC report reader rather than reading the raw files.
3. Fix every legitimate sender. Google Workspace or Microsoft 365, HighLevel, the invoicing tool, the website's contact form and any other platform that sends as the domain all need SPF or DKIM passing and aligned.
4. Move to p=quarantine. Failing mail now goes to spam. Keep watching the reports for a few weeks.
5. Consider p=reject. Only when you're confident nothing legitimate is failing.

The most common mistake is jumping straight to quarantine and discovering the client's invoices were coming from an unauthenticated accounting tool.

Warm-Up and List Hygiene

Authentication gets an email considered. Engagement decides where it lands.

Warm up new domains

• Start with small sends to the most engaged contacts: recent customers and people who opened recently.
• Increase volume gradually over a few weeks rather than sending the whole list on day one.
• Watch bounces and complaints after each send, and slow down if either jumps.

Keep lists clean

• Never send to purchased lists.
• Remove hard bounces immediately.
• Run a re-engagement email to contacts who haven't opened in months, then suppress the ones who still don't respond.
• Make unsubscribing easy. A visible unsubscribe link beats a spam complaint every time.

Migrating a client from another email platform? Our ConvertKit switch guide covers how to move without losing deliverability, and HighLevel email marketing covers the campaigns themselves.

More From NetPartners

• The HighLevel free trial explained: what you get and how long it lasts.
• The 5 workflows every agency builds first: the emails this setup protects.
• Will your tools still work with HighLevel?: yesterday's integrations edition on Substack.
• r/highlevelaffiliates: our small community for HighLevel users and affiliates.

Frequently Asked Questions

Why are my HighLevel emails going to spam?

Usually because the sending domain isn't authenticated with SPF, DKIM and DMARC, the emails use a shared domain instead of a dedicated one or the list includes old and unengaged contacts. Set up a dedicated sending domain, add a DMARC record and clean the list.

What are Gmail's requirements for bulk senders?

Senders of 5,000 or more messages a day to personal Gmail accounts need SPF and DKIM, a DMARC record of at least p=none, From: domain alignment, one-click unsubscribe honored within 48 hours and a spam rate below 0.1%, never reaching 0.3%.

How do I set up a dedicated sending domain in HighLevel?

In the sub-account, go to Settings > Email Services > Dedicated Domain, add a subdomain like replies.yourdomain.com, add the DNS records HighLevel shows you at your DNS host and click Verify Domain.

Should I start DMARC at p=none or p=quarantine?

Start at p=none with reporting turned on. Review the reports for a few weeks, fix every legitimate sender, then move to p=quarantine. Jumping straight to quarantine can send real business email to spam.

Should I use a subdomain or the root domain for sending?

A subdomain, like replies.clientdomain.com, is usually safer. It avoids clashing with the MX records of the client's existing email provider and keeps marketing reputation separate from everyday business email.

Does Outlook have sender requirements too?

Yes. From May 5, 2025, Outlook.com began routing mail from high-volume domains that don't pass SPF, DKIM and DMARC to the Junk folder, with rejection planned to follow.