Home/Support/Authentication and Domains

How to verify your DNS records for an authenticated sending domain

Step-by-step guide to verifying your TouchBasePro authenticated sending domain DNS records using nslookup, dig, or MXToolbox.

This article helps you confirm that the DNS records required for your TouchBasePro authenticated sending domain have been added correctly.

Before you start

  • You should already have received your DNS setup instructions from TouchBasePro (five records in total).
  • You need to have added all five records in your DNS hosting provider (e.g. Cloudflare, GoDaddy, Hetzner, or similar).
  • DNS changes can take up to 24 to 48 hours to propagate, so allow time before testing.

Understanding the five records

TouchBasePro requires five DNS records to authenticate your sending domain. The table below shows the record types you will be checking.

Record Name (example) Type Purpose
1 tbp.yourdomain.co.za CNAME Branded return-path
2 tbp._domainkey.yourdomain.co.za CNAME DKIM signing
3 asuid.tbp.yourdomain.co.za TXT Domain ownership verification
4 yourdomain.co.za TXT SPF (sender authorisation)
5 _dmarc.yourdomain.co.za TXT DMARC policy

Replace yourdomain.co.za with your actual domain throughout.

Option 1: Using nslookup (Windows, macOS, Linux)

nslookup is available by default on most operating systems. Open a terminal or command prompt and run the commands below.

Check CNAME records (Records 1 and 2)

  1. Open your terminal or command prompt.
  2. Run the following command to check Record 1:
    nslookup -type=CNAME tbp.yourdomain.co.za
  3. Confirm the output shows the value 0.touchbasepro.email (or the value from your instructions).
  4. Run the following command to check Record 2:
    nslookup -type=CNAME tbp._domainkey.yourdomain.co.za
  5. Confirm the output shows the expected DKIM CNAME value from your instructions (e.g. za.co.yourdomain.tbp.domainkey.touchbasepro.email).

Check TXT records (Records 3, 4, and 5)

  1. Run the following command to check Record 3 (domain verification):
    nslookup -type=TXT asuid.tbp.yourdomain.co.za
  2. Confirm the output contains the verification string from your instructions.
  3. Run the following command to check Record 4 (SPF):
    nslookup -type=TXT yourdomain.co.za
  4. Look for a TXT record containing v=spf1 and confirm it includes include:touchbasepro.email.
  5. Run the following command to check Record 5 (DMARC):
    nslookup -type=TXT _dmarc.yourdomain.co.za
  6. Confirm the output contains v=DMARC1; followed by your policy (e.g. p=none).

Option 2: Using dig (macOS, Linux)

dig provides more detailed output and is preferred by many administrators. If you are on Windows, you can install it via BIND tools or use WSL.

Check CNAME records (Records 1 and 2)

  1. Open your terminal.
  2. Run the following command to check Record 1:
    dig CNAME tbp.yourdomain.co.za +short
  3. The output should return 0.touchbasepro.email. (note the trailing full stop, which is normal).
  4. Run the following command to check Record 2:
    dig CNAME tbp._domainkey.yourdomain.co.za +short
  5. Confirm the output matches the DKIM CNAME value from your instructions.

Check TXT records (Records 3, 4, and 5)

  1. Run the following command to check Record 3:
    dig TXT asuid.tbp.yourdomain.co.za +short
  2. Confirm the verification string is returned.
  3. Run the following command to check Record 4 (SPF):
    dig TXT yourdomain.co.za +short
  4. Look for the line containing v=spf1 and verify it includes include:touchbasepro.email.
  5. Run the following command to check Record 5 (DMARC):
    dig TXT _dmarc.yourdomain.co.za +short
  6. Confirm the output contains your DMARC policy.

Tip: Adding +short to a dig command returns only the value, making it easier to read.

Option 3: Using MXToolbox (web-based)

MXToolbox is a free online tool that requires no software installation. Visit https://mxtoolbox.com/SuperTool.aspx to get started.

Check CNAME records (Records 1 and 2)

  1. Go to the MXToolbox SuperTool page.
  2. In the search box, type:
    tbp.yourdomain.co.za
  3. From the dropdown, select CNAME Lookup (or type cname:tbp.yourdomain.co.za directly).
  4. Click CNAME Lookup and confirm the result shows the expected value.
  5. Repeat for Record 2 by entering tbp._domainkey.yourdomain.co.za.

Check TXT records (Records 3, 4, and 5)

  1. In the search box, type:
    asuid.tbp.yourdomain.co.za
  2. Select TXT Lookup (or type txt:asuid.tbp.yourdomain.co.za).
  3. Confirm the verification string is present.
  4. To check SPF, type spf:yourdomain.co.za and click SPF Record Lookup. Confirm include:touchbasepro.email appears in the record.
  5. To check DMARC, type dmarc:yourdomain.co.za and click DMARC Lookup. Confirm your DMARC policy is returned.

What a correct result looks like

Below are example outputs for a domain called carfind.co.za using dig:

$ dig CNAME tbp.carfind.co.za +short
0.touchbasepro.email.

$ dig CNAME tbp._domainkey.carfind.co.za +short
za.co.carfind.tbp.domainkey.touchbasepro.email.

$ dig TXT asuid.tbp.carfind.co.za +short
"915697691CF02C685CB48CAAF0E42D2CF06FB569446DD3CB16833D22033204FC"

$ dig TXT carfind.co.za +short
"v=spf1 include:touchbasepro.email ~all"

$ dig TXT _dmarc.carfind.co.za +short
"v=DMARC1; p=none"

Troubleshooting common issues

No result or NXDOMAIN

  • The record has not been created, or DNS propagation has not completed. Wait up to 48 hours and try again.
  • Double-check the record name for typos in your DNS hosting panel.

CNAME shows an IP address instead of a hostname

  • You may have created an A record instead of a CNAME. Delete the A record and create a CNAME record with the correct value.

SPF record missing touchbasepro.email

  • If you already had an SPF record, you need to add include:touchbasepro.email to the existing record rather than creating a second SPF TXT record. Having two SPF records on the same domain will cause validation failures.
  • Example of a merged SPF record:
    v=spf1 include:_spf.google.com include:touchbasepro.email ~all

DMARC record not found

  • If you already have a DMARC record, do not change it. Only create Record 5 if no DMARC record exists.

Cloudflare or CDN proxy is enabled

  • If you use Cloudflare or a similar CDN, make sure the proxy (orange cloud icon) is turned off for all five DNS records. Set them to DNS only (grey cloud). Proxied records will not resolve correctly for mail authentication.

After verification

Once all five records return the correct values, log in to your TouchBasePro account and check the domain authentication status. The platform will automatically detect the records and mark your domain as verified. If the status does not update within 48 hours of adding the records, contact TouchBasePro support for assistance.

← Back to Authentication and Domains