(Credit: Thomas Fuller/SOPA Images/LightRocket via Getty Images)
Don't miss out on our latest stories. Add PCMag as a preferred source on Google.
Microsoft has taken aim at spammers who are abusing its onmicrosoft.com domain—otherwise known as Microsoft Online Email Routing Address (MOERA)—for their campaigns.
When you or your organization sets up an email account in Microsoft 365, you're automatically given an onmicrosoft.com domain, which users often quickly change to match their company (like pcmag.com). But spammers can use these domains to flood inboxes with emails, simply creating new domains whenever the old ones are flagged by Microsoft’s anti-spam defenses.
Starting Dec. 1, organizations using the domain will be capped at sending emails to just 100 external recipients within a 24-hour period. These restrictions will initially apply only to smaller organizations with fewer than three seats (separate accounts registered to one organization).
Microsoft plans to roll out the new restrictions gradually. On Jan. 7, 2026, the restrictions will apply to organizations with up to 10 seats, progressing to those with up to 50 on Feb. 2, 2026. The restrictions will eventually impact organizations with over 10,001 seats by June 1, 2026.
If your emails are blocked because you hit this threshold, you'll receive an NDR (Non-Delivery Report) message with the error code 550 5.7.236.
There's a fairly simple solution to avoid the new limits. Users can purchase and migrate to a custom domain or ensure that only custom domains are used for sending external emails.
As noted by The Register, one issue that could cause headaches for users is if organizations use onmicrosoft.com as their primary SMTP address. Changing it will impact usernames across the organization. This means you'll need to manage and ensure credential updates across all your company's devices and applications (or even let clients and partners know).
Microsoft will notify customers impacted by each stage of the rollout one month before via the Message Center, but it encourages all customers using onmicrosoft.com "to start planning and migrating today."
Though cracking down on spam benefits almost everyone, The Register points out that the new restrictions come into play around the time many versions of Windows 10 reach end of life, meaning that already swamped Microsoft administrators could have even more to deal with.