Microsoft Limits Onmicrosoft Domain Usage for Email Sending
by
Reading Time: 3 min
Microsoft has announced a major policy change that will affect how organizations use their default onmicrosoft.com domains. These free domains, known as MOERA (Microsoft Online Email Routing Address) domains, are provided when a new Microsoft 365 tenant is created.
While originally intended for quick setup and testing, many businesses have continued using them for daily communication. This practice has led to deliverability issues and domain reputation problems, prompting Microsoft to enforce new restrictions.
Key Takeaways
- Onmicrosoft domains are for testing, not regular communication.
- New limits cap outbound mail to 100 external recipients per day.
- Rollout begins October 15, 2025, and continues into 2026.
- Organizations should migrate to custom domains immediately.
- Custom domains improve security, deliverability, and brand identity.
Why Onmicrosoft Domains Are a Problem
MOERA domains are shared across tenants, meaning their reputation is collective. When spammers exploit these domains to send fraudulent emails, the impact is felt by legitimate users as well.
Additionally, using a generic domain name diminishes brand identity and reduces administrative control. As a result, emails sent from onmicrosoft addresses often struggle to maintain trust and consistent delivery.
The New Throttling Policy
To reduce abuse and encourage best practices, Microsoft will begin throttling outbound email from onmicrosoft domains. Starting October 15, 2025, tenants will be limited to sending 100 external emails per day from these domains.
The rollout will be gradual, expanding through mid-2026, based on the number of Exchange seats in each organization. Inbound mail will not be affected.
What Organizations Should Do
Microsoft strongly recommends that businesses move to custom domains for regular email use. Key steps include:
- Purchasing a custom domain from a registrar.
- Adding the domain to Microsoft 365 and verifying ownership.
- Updating user mailboxes with the new domain as the primary SMTP address.
- Configuring apps like Bookings and notifications to use the custom domain.
Final Words
While Microsoft recently enforced bulk sender requirements, this change further signals Microsoft’s focus on email security and deliverability. While MOERA domains remain useful for testing, organizations that rely on them for daily communication may soon find themselves facing restrictions. Moving to a custom domain not only prevents throttling but also strengthens brand presence and builds customer trust.
Frequently Asked Questions
1. What is a MOERA domain?
A MOERA (Microsoft Online Email Routing Address) domain, such as contoso.onmicrosoft.com, is the default domain assigned when a new Microsoft 365 tenant is created.
2. Why is Microsoft limiting email sending from onmicrosoft domains?
MOERA domains are often abused by spammers, which harms their overall reputation. By limiting usage, Microsoft aims to protect email deliverability and encourage organizations to use custom domains.
3. Will inbound emails to onmicrosoft domains be affected?
No. The throttling only applies to outbound messages. Incoming emails will not be blocked or limited.
4. Who will be affected by this change?
Any organization using onmicrosoft.com (or regional variants) as its primary sending domain will be impacted. The rollout schedule depends on the number of Exchange seats in the tenant.
5. Can MOERA domains still be used at all?
Yes, but only for testing and internal use. They are no longer suitable for regular external communication.
6. When will the rollout be complete?
The rollout will take place in stages from October 2025 through June 2026, depending on tenant size.
Domain & Email Security Expert at PowerDMARC
Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.
Latest posts by Ahona Rudra (see all)
- Microsoft Limits Onmicrosoft Domain Usage for Email Sending - August 25, 2025
- Zero Day Vulnerability: Examples, Detection, and Prevention - August 25, 2025
- Social Engineering: Recognize and Prevent Attacks - August 25, 2025
