If emails come back with this bounce:
550 5.7.236 Your message can't be sent because your tenant has exceeded its
daily limit for sending email to external recipients from your tenant's
onmicrosoft.com domains
your Microsoft 365 organisation is still sending some of its mail from the
yourcompany.onmicrosoft.com address Microsoft created when the tenant was
set up. Microsoft now limits that.
What changed
Microsoft limits mail sent from a tenant's onmicrosoft.com domains to
100 external recipients in any rolling 24 hours, for the whole tenant.
Mail coming in isn't affected, and nor is mail between your own users.
It rolled out by tenant size between October 2025 and June 2026, so every tenant is now covered:
| From | Tenants with |
|---|---|
| 15 Oct 2025 | trial tenants |
| 1 Dec 2025 | fewer than 3 mailboxes |
| 7 Jan 2026 | 3–10 |
| 2 Feb 2026 | 11–50 |
| 2 Mar 2026 | 51–200 |
| 1 Apr 2026 | 201–2,000 |
| 4 May 2026 | 2,001–10,000 |
| 1 Jun 2026 | more than 10,000 |
How the 100 are counted:
- Recipients are counted after distribution lists are expanded, so one email to a 150-member list uses them all.
- Out-of-office replies and bounces don't count; delivery receipts do.
Why it happens to you
The limit only bites if mail actually goes out from @yourcompany.onmicrosoft.com.
Common reasons:
- No custom domain was ever added, or users' primary address is still the onmicrosoft one.
- The default domain is still onmicrosoft.com, so new users, shared mailboxes and Microsoft's own notifications use it.
- Devices and apps (scanners, printers, line-of-business apps) were set up with an onmicrosoft address years ago.
- Postmaster and system mail: the external postmaster address, meeting forward notifications, Bookings and Microsoft 365 product notifications can all use the default domain.
The fix
- Add your own domain to Microsoft 365 if it isn't there, and publish the DNS records the admin centre gives you (MX, SPF, autodiscover).
- Make it the default domain: Microsoft 365 admin centre → Settings → Domains → select your domain → Set as default. A federated domain can't be the default; use another custom domain.
- Change every mailbox's primary address to the custom domain. Keep the onmicrosoft address as an alias so nothing addressed to it bounces.
- Check other senders: the external postmaster address, Bookings, and which domain Microsoft 365 uses for product notification emails.
- Update devices and apps. Changing a primary address can change the username they sign in with, so scanners, printers and apps that send through Microsoft 365 may need new credentials.
When people reply to mail sent to their old onmicrosoft alias, Outlook may pick that alias as the sender. Ask them to choose the custom address.
Find what's still sending from onmicrosoft.com
In the Exchange admin centre, run a message trace with the sender set
to *@yourcompany.onmicrosoft.com for the last few days, and filter out
internal recipients. Everything left is a sender to move.
While you're there: DKIM, SPF and DMARC
A custom domain is only half the job. Without DKIM, SPF and DMARC on it, mail from your own domain is easier to spoof and more likely to land in spam. See set up DKIM and DMARC from none to reject, and if DKIM won't turn on, Microsoft 365 DKIM won't enable.
Check your domain
The DMARC checker shows whether your domain's SPF and DMARC are in place, and the free scan checks your mail servers and lookalike domains that could send as you.