Sending from the onmicrosoft.com domain
Default onmicrosoft.com addresses are throttled to 100 external recipients a day per organisation and carry no reputation of your own. Always send from a custom domain.
Warm-up by provider
Short answerTo warm up a Microsoft 365 mailbox, publish SPF, DKIM and DMARC for the domain, connect the mailbox with OAuth, and ramp from 2-5 to 30-50 emails a day over two to four weeks. Exchange Online allows far more (10,000 recipients a day), but cold-email mailboxes should stay well below its limits.
Step by step
Connection method: OAuth (Microsoft sign-in).
In RoxInbox, choose Add mailbox, then Microsoft 365 / Outlook.
Sign in with the mailbox's Microsoft account and approve access. Your admin may need to approve the app once for the tenant.
RoxInbox checks the domain's SPF, DKIM and DMARC before it sends anything.
Fix anything flagged, then start the ramp.
Sending limits 2026
These are technical ceilings for normal business email, not targets. Microsoft states that Exchange Online isn't suited to bulk mailing. For cold email, stay around 30-50 emails per mailbox per day.
| Limit | Value |
|---|---|
| Recipient rate limit, per mailbox | 10,000 recipients per day |
| Message rate limit | 30 messages per minute |
| Recipients per message | Customisable, up to 1,000 |
| Tenant external recipient limit (TERRL) | Depends on the tenant's number of licences; trial tenants are capped at 5,000 external recipients a day |
| Default onmicrosoft.com domains | Limited to 100 external recipients per organisation per day |
Source: Microsoft Learn: Exchange Online limits, checked 14 October 2026.
Ramp plan
RoxInbox adapts this daily from real spam signals. Use the calculator for a plan for your own domain.
| Week | Emails per day | Note |
|---|---|---|
| Week 1 | 3-8 | Warm-up only, no campaigns |
| Week 2 | 8-18 | Watch for Junk placement at Outlook seeds |
| Week 3 | 18-35 | Run a placement test at the end of the week |
| Week 4 | 35-50 | Start campaigns at a fraction of the plateau |
Pitfalls
Default onmicrosoft.com addresses are throttled to 100 external recipients a day per organisation and carry no reputation of your own. Always send from a custom domain.
Microsoft 365 doesn't sign with your domain's DKIM until you enable it in the Defender portal and publish the selector1 and selector2 CNAMEs.
More than 30 messages a minute is throttled. Spread sends across the working day.
Since May 2025 Microsoft requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to outlook.com, hotmail.com and live.com addresses.
FAQ
Technically up to 10,000 recipients a day. For cold email, start at 2-5 a day and plateau at 30-50, because filters judge new senders on behaviour, not on what the account is allowed to send.
Usually missing DKIM, a DMARC record that fails alignment, a new domain with no history, or a sudden volume increase. Run the domain health check, then a placement test to see whether it's Outlook only or every provider.
Some tenants only allow users to approve apps that an admin has approved. If you see an approval request, ask your Microsoft 365 admin to grant consent once for the organisation.
Other providers: Google Workspace · Yahoo Mail · Zoho Mail · iCloud Mail · Mail.ru · Yandex Mail · GMX / WEB.DE · Corporate SMTP
RoxInbox connects in five minutes, checks your DNS first, and shows placement at every provider.