Giving Church Plant Media access to review and set up Microsoft 365 email authentication

Church Plant Media (CPM) can help verify that email sent from your church’s domain is properly authenticated. We’ll review your SPF, DKIM, and DMARC records and compare your published DNS records with the values Microsoft 365 expects for your domain, including MX for incoming mail and Autodiscover for Outlook.

Your church’s DNS is hosted separately. We can check published SPF and DMARC records publicly. The Microsoft 365 access below lets us see your domain’s expected records, check whether Microsoft is signing outgoing messages with DKIM, and enable signing if needed. Any DNS updates are made separately at your DNS host.

Ask your church’s Microsoft 365 administrator or IT provider to complete these steps.

1. Create a Microsoft 365 account for CPM

If the CPM team member assisting you already has a sign-in for your church’s Microsoft 365 account, go directly to step 2.

1. Sign in to the Microsoft 365 admin center.
2. Go to Users → Active users → Add a user.
3. Enter the CPM team member’s name from your support ticket. Choose a username on your church’s domain, such as cpm@yourchurch.org.
4. Let Microsoft generate a temporary password and keep the option to require a password change at first sign-in selected.
5. Choose Create user without product license, then finish adding the account. An account used only for administration does not need a paid mailbox.

2. Grant access to view Microsoft’s expected DNS records

1. Go to Users → Active users and select the CPM account.
2. Select Manage roles. If necessary, select Show all to see the full list.
3. Select Global Reader, then Save changes. This grants read-only visibility across Microsoft 365, including the service records Microsoft specifies for your church’s domain.

If you purchased Microsoft 365 through a reseller and Global Reader is unavailable, ask your provider to send CPM the expected values shown under Settings → Domains → your church’s domain → DNS records.

3. Grant access to set up DKIM

Complete this step if CPM is handling setup. For a review only, skip to step 4.

1. Open the Admin roles page in the Exchange admin center.
2. Select Hygiene Management → Assigned → Add.
3. Search for the CPM account, select it, and click Add to confirm. This gives CPM permission to retrieve your domain’s two DKIM records and enable signing after the records are published.

4. Let CPM know access is ready

Reply to your existing CPM support ticket with the username, your church’s email domain, and any other services that send mail using an address on that domain. Common examples include Mailchimp, Planning Center, giving platforms, and website forms. Knowing which services you use helps us account for legitimate senders when reviewing your email authentication.

Share the temporary password directly with your CPM team member using a secure method, such as a one-time password link. Keep passwords and verification codes out of the support ticket.

Once CPM confirms the work is complete, remove Global Reader from the CPM account and remove the account from Hygiene Management if you added it there. The DNS records and DKIM signing will continue to work after temporary access is removed.

Microsoft documentation: Assign admin roles · Microsoft 365 DNS records · Set up DKIM.