Exchange Online Imposes Stricter Email Limits on onmicrosoft.com Domains

Microsoft is enforcing stricter controls on the use of onmicrosoft.com domains in Exchange Online. Starting on October 15, the company will start throttling outgoing emails to reduce misuse and improve trust.

The default onmicrosoft.com domains are mainly used for setting up and testing Microsoft 365 tenants. However, these Microsoft Online Email Routing Address (MOERA) domains have major drawbacks for regular email use in enterprise environments. They don’t reflect an organization’s brand, offer limited administrative control, and are shared across all tenants.

Consequently, spammers often take advantage of MOERA domains, which harms their overall reputation. This can lead to legitimate emails being flagged as spam or blocked entirely, hurting both email delivery rates and the sender’s brand credibility.

What do the new email throttling rules mean for Exchange Online customers?

Previously, Microsoft didn’t impose any restrictions on the use of MOERA domains for sending emails. The company is now introducing limits on the use of MOERA domains for sending emails and encourages organizations to migrate to custom domains. Administrators should ensure that only custom domains are used for sending non-test emails.

“We will be introducing throttling to limit messages sent from onmicrosoft.com domains to 100 external recipients per organization per 24 hour rolling window. Inbound messages won’t be affected. External recipients are counted after the expansion of any of the original recipients. When a sender hits the throttling limit, they will receive NDRs with the code 550 5.7.236 for any attempts to send to external recipients while the tenant is throttled,” Microsoft explained.

Timeline for the rollout of restrictions

Starting on December 1, Microsoft will begin applying the email sending restrictions across tenants with fewer than 3 seats. By June 2026, the same restrictions will extend to large tenants with over 10,001 seats.

Microsoft advises administrators to update mailboxes so that the custom domain becomes the primary SMTP address. However, this change can also alter usernames that require credential updates across devices and apps. For IT teams, this creates extra workload, especially as many Microsoft products, including several Windows 10 versions, approach their end-of-support deadlines.

In May, Microsoft released a new Reject Direct Send feature in preview for Exchange Online customers. This control helps administrators boost protection against unauthorized email traffic.