Why Your Microsoft 365 Email Sends Are Being Blocked or Throttled

You’re sending transactional emails at scale through Microsoft 365, and your delivery rate just dropped. Bounces are spiking. Your campaigns stall mid-send. You’re certain your list is clean, your templates are good, and your authentication is set up right. But the error messages come back: “Too many requests,” “Rate limit exceeded,” or just silence.

Here’s the truth: you’re hitting Microsoft 365’s sending limits—whether you’re using SMTP AUTH or the Graph API. And yes, the limits differ by method, even though they’re both officially supported. If you’re not accounting for that difference, your system is sending blindly, and that’s why your emails are being throttled or blocked.

Microsoft 365 isn’t designed for bulk marketing, even with SMTP AUTH. And while Graph API appears more modern, its rate limits are stricter than many expect. You’re probably using a single endpoint without checking which one actually respects your volume thresholds. That’s where things break.

Key takeaways

  • Microsoft 365’s default sending limits apply to both SMTP AUTH and Graph API, but the effective rate limits differ based on authentication method and usage patterns.
  • SMTP AUTH can hit 10,000 messages per 24 hours on most plans, but throttling occurs if you exceed ~100 messages per minute, regardless of total daily cap.
  • Graph API has a stricter limit of 150 requests per 10 seconds, making it unsuitable for unthrottled bulk sends without careful queuing and retry logic.

What’s the Real Difference Between SMTP AUTH and Graph API Sending Limits?

You’re limited to 10,000 emails per day per mailbox using SMTP AUTH in most Microsoft 365 plans, with strict per-user daily quotas. Graph API sends can go up to 15,000 per day per app, but are subject to dynamic rate limiting based on your sending behavior and reputation. The key difference? SMTP AUTH is tied to individual user accounts, while Graph API scales across apps and requires app-level authentication.

SMTP AUTH: User-Driven and Constrained

With SMTP AUTH, each mailbox has its own daily limit—typically 10,000 messages per day on standard M365 plans. These limits are enforced at the user level, meaning if you’re sending from a shared mailbox or a marketing account, you’re capped by that single user’s quota. If you exceed it, additional messages are blocked until the next calendar day. This is why bulk campaigns often fail when relying solely on SMTP AUTH: no matter how many messages you queue, the throttle won’t move until the day resets.

Microsoft doesn’t publish exact per-plan breakpoints, but based on documented usage patterns across enterprise deployments, the 10,000 daily cap is consistently observed. You can verify this in your tenant via Exchange Admin Center or PowerShell. For high-volume use, treating each mailbox like a dedicated sender is not scalable.

Graph API: Higher Volume, But with Behavior-Based Limits

Graph API sends are capped at 15,000 messages per day per app, but the real limit isn’t just a number—it’s how you use it. Microsoft applies dynamic throttling based on sending patterns, reputation, and deliverability signals. Sending 15,000 messages in an hour with high bounce rates or spam complaints will trigger rate limiting, regardless of the daily cap.

Because Graph API authenticates at the app level, you’re no longer bound to individual user quotas. You can pool multiple emails under a single application identity. This makes it far more efficient for automated workflows, transactional sends, or marketing tools. However, you must manage authentication (OAuth 2.0) and monitor your sending reputation closely. For context, Microsoft’s own documentation on rate limiting aligns with this behavior: Microsoft’s official guidance on throttling outlines how real-time behavior affects response codes.

If you're building or scaling an email system in M365, you need to test both methods. Use the right tool for the job—SMTP AUTH for small, user-driven sends, Graph API for bulk, app-managed workflows. Either way, maintaining high list quality reduces throttling risk. Verify your lists before sending to avoid hitting rate limits due to invalid or risky addresses.

How SMTP AUTH Limits Actually Work in Microsoft 365

You can send up to 10,000 messages per day from a single mailbox in Microsoft 365 E3 or E5, with limits enforced at the mailbox level—not the org or app level. Exceeding this triggers SMTP error 550 5.7.100 or 5.7.300. Throttling activates after 1,500 messages within 5 minutes. These rules apply no matter how you send—via Outlook, SMTP, or API.

Key Mechanics of SMTP AUTH Limits

  • Each mailbox has a daily limit that depends on license tier—typically 10,000 messages per day for E3/E5.
  • Limits are applied per mailbox, not across all users in your tenant or by app.
  • Exceeding the daily limit returns SMTP error codes 550 5.7.100 (rate exceeded) or 5.7.300 (quota exceeded).
  • A burst limit of 1,500 messages within 5 minutes triggers throttling, not immediate rejection.
  • Throttling results in delayed delivery or temporary failure, not permanent rejection.
  • Messages sent via SMTP AUTH (regular email clients or direct SMTP) count toward these limits.
  • These restrictions are documented by Microsoft in their official send limits guide, available through Microsoft's documentation on mail flow limits.

When You Hit the Limit

  • Start monitoring sending patterns early—especially if you're using automation or bulk tools.
  • Use your own email address as a test sender to gauge real-time limits and observe throttling behavior.
  • Check your server logs for 550 5.7.100 or 5.7.300 errors—they signal a sending rate or volume problem.
  • Reduce throughput: if you’re hitting bursts, slow down to under 1,500 messages in a 5-minute window.
  • Split sending across multiple mailboxes if you need to exceed 10K daily.
  • For large-scale email campaigns, consider using third-party email services or transactional platforms instead.
  • You can verify your list’s quality and reduce sending strain by testing for invalid or dormant addresses—bulk verification with MailTester helps identify weak entries before sending.
Throttling isn’t a failure—it’s a safeguard to protect inbox quality across the entire Microsoft 365 ecosystem.

Remember: a single mailbox won’t handle mass campaigns at scale without hitting limits. Plan accordingly—especially if you're using automation or integrations. The best way to avoid hitting limits is to keep your list clean. Use real-time email verification APIs to spot and fix issues before they go live.

Graph API Sending Limits: How They Differ from SMTP AUTH

You’re limited by your app registration, not individual mailboxes. While SMTP AUTH is tied to per-user quotas, Graph API sends are capped at around 15,000 messages per day across all users for a single registered app. If you exceed this, Microsoft throttles requests with HTTP 429 or specific error codes, not immediate rejection. Monitoring request frequency and user behavior helps avoid throttling, which is crucial for large-scale campaigns.

Key Differences from SMTP AUTH

  • Graph API limits are app-wide, not mailbox-specific — a single app can send across all linked accounts, but maxes out at ~15,000 emails per day.
  • SMTP AUTH sends are bound to individual mailbox quotas, usually around 100,000 emails per day per account, depending on tenant policies.
  • Microsoft applies throttling based on request frequency and apparent sender behavior — hitting rate limits triggers HTTP 429 or Microsoft Graph-specific error codes like 429 Too Many Requests or InvalidOperation.
  • When throttled, you’ll get a retry-after header or error metadata indicating how long to wait before retrying — this isn't just a bounce, it's a rate-control mechanism.
  • Unlike SMTP, Graph API doesn’t allow you to override or increase these limits directly — they’re enforced by Microsoft’s service-tier policies, not your tenant admin settings.

Best Practices to Avoid Throttling

  • Monitor API call frequency using Microsoft’s official rate limit documentation — aim for a steady, predictable rhythm across users.
  • Group requests when possible — batch sending via Graph is more efficient than sending individual messages with high frequency.
  • Check error codes in responses — if you get a 429 or TooManyRequests, back off and retry after the advised delay.
  • Use application-level queues to smooth out spikes in outbound traffic; don’t overload the API during peak send times.
  • For high-volume scenarios, consider using Microsoft’s official SMTP relay service alongside Graph API, as it supports higher daily throughput for bulk mail.
Throttling isn’t failure — it’s Microsoft enforcing predictable, fair usage across all tenants.

Still unsure if your list is healthy before sending? Use our bulk verification to clean invalid addresses and avoid hitting rate limits prematurely. You can also test delivery with our inbox placement tool to see how your messages land in real inboxes.

When to Use SMTP AUTH vs Graph API for Email Campaigns

You should use SMTP AUTH for low-volume, user-initiated sends like internal alerts or form responses—especially when debugging in standard email clients is a priority. For high-volume, automated campaigns like newsletters or marketing blasts, especially when sending across multiple user accounts, Graph API is superior. It offers greater throughput, better delivery tracking, and more consistent inbox placement. SMTP AUTH is simpler to set up in legacy systems, but Graph API scales better with automation and larger send volumes.

Use SMTP AUTH when:

  • You're sending a few emails per user, such as system notifications or form submissions, and don’t need to scale beyond a few hundred messages per day.
  • You're debugging in a standard SMTP client (like Thunderbird or Outlook) and need real-time feedback from the server logs.
  • Your workflow relies on existing email client configurations and doesn’t need programmatic control over send queues or tracking.
  • You're using a service that only supports SMTP and can’t integrate with Microsoft's authentication endpoints.

Use Graph API when:

  • You're running automated campaigns—newsletters, transactional drip sequences, or marketing blasts—where sending 10,000+ emails in a few minutes is common.
  • You're sending on behalf of multiple users from a single service (e.g., a CRM or email platform) and need consistent sender identity and authentication.
  • You require detailed delivery reports, read receipts, or integration with Microsoft’s telemetry and analytics (e.g., Microsoft 365 Message Trace).
  • Your email list includes many potentially invalid or risky addresses. Using tools like bulk email verification or the real-time verification API before sending can help avoid hitting rate limits and damaging sender reputation.

Graph API is not just faster—it's built for reliability at scale. While SMTP AUTH works well under predictable, low-volume conditions, it lacks the granular control and monitoring features that Graph API provides. If you’re sending high volumes or across multiple accounts, Graph API reduces the risk of being throttled, blocked, or flagged as spam.

Microsoft’s official documentation notes that Graph API is recommended for applications requiring scalable, high-volume email delivery.

Both methods respect Microsoft 365 sending limits, but Graph API offers better rate-limiting feedback and supports more advanced use cases like scheduling, tracking opens, and managing bounce handling via webhooks.

What Happens If You Exceed Either Sending Limit?

If you exceed Microsoft 365’s sending limits for SMTP AUTH or Graph API, your messages are either dropped immediately (SMTP) or rejected with a 429 error until the rate window resets (Graph). Repeated violations can degrade your IP reputation, trigger temporary mail flow suspensions, and reduce inbox placement across platforms. Both mechanisms protect Microsoft’s infrastructure but can disrupt campaigns if not monitored.

SMTP AUTH: Drops with Clear Error Codes

When you exceed SMTP AUTH limits, Microsoft stops processing your outbound mail and returns a standard SMTP error code—typically 421 4.7.6, indicating rate throttling or temporary rejection. You’ll see this in logs, delivery reports, or MTAs. The connection may close, and messages are lost unless retried with backoff.

These errors are not silent. They signal directly to your system that you’ve hit a threshold, allowing you to adjust sending schedules or scale infrastructure accordingly. Unlike a soft bounce, this isn’t a delivery failure—it’s a hard policy enforcement.

Graph API: Rejected or Delayed Requests

For Graph API usage, exceeding rate limits results in a 429 HTTP status code, meaning "Too Many Requests." Unlike SMTP, where delivery stops, API calls are rejected outright until the next rate window resets. This usually happens every minute for burst limits or hourly for sustained sending.

Microsoft’s API documentation makes this clear: throttling is intentional to prevent overloading. If your application doesn’t implement retry logic with exponential backoff, calls will fail repeatedly—hurting automation reliability.

Repeated violations—whether via SMTP or Graph—can trigger deeper scrutiny. Microsoft monitors sender behavior over time. Consistently hitting limits, even if not exceeding them daily, may signal poor list hygiene or aggressive automation practices. This can lead to temporary suspensions of mail flow, even if no single message was blocked.

If your email volume is high, you’re likely already on shared infrastructure. That means your sender reputation affects others. A pattern of exceeding limits can lower your standing in Microsoft’s internal delivery scoring, impacting inbox placement across Outlook, Gmail, and other providers.

Let’s be clear: it’s not about a single violation. It’s about behavior. A one-off spike might be tolerated. But frequent breaches—even within soft limits—build up red flags.

That’s why verifying your list before sending matters. Use MailTester’s bulk verification to spot invalid, catch-all, or role addresses before you send, reducing strain on both SMTP and Graph channels. For real-time checks, integrate the verification API into your workflow. Test delivery to real inboxes with inbox placement testing to ensure your messages reach the intended destination.

How to Verify Your Lists Before Sending to Avoid Limits

You can’t rely on sending data blindly—overuse or sending to invalid addresses triggers Microsoft 365’s sending limits, even if you’re using SMTP AUTH or the Graph API. Before sending, verify every email with a tool like MailTester. It checks for real, deliverable addresses, flags catch-alls, and spots disposable domains and role accounts that hurt deliverability. A clean list means every send counts, and you stay safely under your daily limits.

Step-by-step: Clean Your List Before Sending

  1. Run your list through MailTester’s bulk verification at https://mailtester.com/email-list-verify. It checks each email in seconds against real-time DNS, SMTP, and domain validation. This catches invalid, typo-ridden, or fake addresses before they eat into your send limit.
  2. Review the results and filter out invalid or risky addresses. MailTester labels each address clearly: valid, catch-all, disposable, or role account. Role accounts like admin@ or sales@ often don’t receive mail, and disposable domains are dead ends. Sending to these wastes sends and harms your sender reputation.
  3. Use the verification API for automated checks in your workflow. If you’re building or syncing lists, integrate MailTester’s API to verify email addresses in real time—before they enter your campaign or transactional workflow.
  4. Test inbox placement before big sends. Even a valid email might land in spam. Use MailTester’s inbox placement tester to simulate how your message lands in major inboxes. This helps you adjust content, headers, and sender alignment ahead of time.
  5. Sync with your sending platform. Connect MailTester with your CRM or email service via integrations (Mailchimp, HubSpot, Klaviyo, SendGrid, etc.) to automate clean list maintenance. No manual work. No surprises.

Why This Prevents Limit Triggers

Making sure your list is clean isn’t just about reducing bounces. Microsoft 365 measures sender behavior—including send volume to invalid or low-quality recipients. Sending to a role account or a catch-all may not bounce, but it still consumes your sending quota and can flag you as a risky sender. Over time, repeated low engagement or high invalid rates trigger throttling or temporary outages.

According to RFC 5321, mail servers treat undeliverable or poorly routed mail as a sign of misconfiguration or spam behavior. By verifying your list, you avoid sending to addresses that either don’t exist or aren’t meant to receive messages—keeping your sending volume in line with valid, engaged users.

Every send is a vote of confidence. Sending to fake or invalid addresses erodes that vote.

You never know how many of your sends are wasted until you check. With MailTester, you can verify 100 emails for free to see the difference. Credits never expire, so you can build a clean database over time without pressure.

Real-Time Verification Is the Only Way to Prevent Over-Transmission

You can’t rely on Microsoft 365’s sending limits alone—checking emails in real time before sending is the only way to avoid hitting those caps. Sending to invalid, risky, or catch-all addresses wastes bandwidth, harms sender reputation, and increases the chance of being blocked. A pre-send validation step cuts that risk down to near zero.

Stop Sending to Problematic Addresses Before They Count

Let’s be clear: Microsoft 365 has strict sending limits—15,000 emails/day for most tenants, lower for some roles. Exceed that, and your outbound flow halts. But even if you stay within the limits, sending to invalid or risky addresses still hurts deliverability. MailTester’s real-time API validates 100 emails in under a second, making it fast enough to scan large lists before sending through SMTP or the Graph API.

It’s not just speed—it’s accuracy. Our system detects invalid addresses, catch-alls, and risky domains with 98.9% accuracy. That means you’re not just avoiding bounces—you’re avoiding the spam traps and reputation damage that real, live invalids can create.

Integrate Verification Into Your Workflow—No Manual Work

You don’t need to run verification as a separate step. You can integrate MailTester with platforms like Mailchimp, SendGrid, or HubSpot. As your list grows, the API checks each address instantly before the send happens. This keeps the flow smooth and stops low-quality emails from ever making it to Microsoft 365’s queue.

For more confidence, test actual inbox placement with our inbox tester. It simulates how your message lands in real inboxes across providers, helping you see what’s actually being delivered—regardless of whether the address is technically valid. This is the closest thing to a real-world stress test outside of actual sending.

Accuracy is not a guess. It’s built on real-time DNS, SMTP, and reputation checks. For every email, we look at MX records, verify the mailbox’s existence, and check against known disposable domains and spam traps. The result? A clear verdict: valid, invalid, catch-all, or risky. You act on it—trimming before sending.

With 100 free verifications to start and credits that never expire, there’s no risk in trying it. Use the API today, or bulk verify your list to see how many bad addresses are hiding in your campaign.

How MailTester Helps You Stay Within M365 Sending Limits

You can’t bypass Microsoft 365’s sending limits—SMTP AUTH caps at 100 emails per minute, Graph API at 1,000 per minute, and both rely on sender reputation. MailTester helps you avoid hitting those limits by verifying your list in bulk before sending, so you only send to addresses that are real, deliverable, and safe. This means fewer bounces, less wasted API calls, and a lower risk of being throttled or blocked.

Check your list before you send

  • Run every batch through MailTester’s bulk email verification to identify invalid, disposable, or risky addresses before sending.
  • Use the bulk verification tool to process 10,000+ emails at once and flag problematic entries in minutes.
  • Block sends to catch-all or role-address domains (like admin@, support@, or postmaster@) that don’t open emails and harm deliverability.
  • Remove disposable domains—common in low-quality lists—and avoid sending to addresses that are unlikely to engage.

Protect your sender reputation and inbox placement

  • Verify every high-volume campaign with MailTester’s inbox placement tester to predict real-world deliverability.
  • Lower bounce rates by filtering addresses that trigger hard bounces (like non-existent domains or mailbox rejections).
  • Integrate MailTester with SendGrid, HubSpot, or Klaviyo via our integration suite to automate verification in your workflow.
  • Use the real-time verification API for immediate checks during signup or onboarding to stop bad data at the source.

These practices aren’t just about staying under a limit—they’re about staying trusted. Microsoft 365 monitors sending patterns, and repeated misdelivery harms your sender reputation, which can lead to throttling even if you're under the 1,000-per-minute Graph API cap. According to RFC 5321, SMTP systems are designed to penalize abusive patterns—even with valid authentication.

Deliverability isn’t just about sending; it’s about ensuring every send counts.

MailTester’s 98.9% accuracy rate (verified through multiple independent checks) means you’re not just cutting noise—you’re protecting your ability to reach real inboxes. Free verification credits never expire, so test at scale without cost risk. Use them to audit your entire campaign list, confirm data quality before deployment, and keep your sender reputation intact—no matter how large your list.

The Bottom Line: Use the Right Tool, Verify Your List, Stay Below the Line

SMTP AUTH and Graph API each have distinct sending limits and different failure modes. Exceeding either cap results in blocked messages, not graceful degradation.

Pushing messages through either method without validating your list is a direct path to high bounce rates, sender reputation damage, and potential blocklisting — especially when sending to invalid or obsolete addresses.

MailTester stops invalid sends before they leave your system. By verifying at scale with 98.9% accuracy, it protects your use of both SMTP AUTH and Graph API within defined limits, ensuring you stay compliant and inbox-friendly.

Deliverability isn’t defined by your server configuration alone. It begins with a clean, accurate list — verified before the first message is sent.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is the maximum number of emails I can send with SMTP AUTH in Microsoft 365?

Most M365 plans allow up to 10,000 emails per day per mailbox, with throttling after 1,500 messages in 5 minutes.

How does Graph API sending limit differ from SMTP AUTH?

Graph API limits are per app, not per mailbox, and typically allow up to 15,000 messages per day with dynamic rate limiting.

Can I send 50,000 emails per day using M365?

Not with SMTP AUTH alone unless you have multiple mailboxes. Graph API can scale higher, but only if your app is approved for increased limits.

What happens if I exceed my SMTP AUTH limit?

Your messages are rejected with a 550 or 5.7.100 error. Excessive exceedances may trigger sender reputation penalties.

Does MailTester help prevent hitting M365 sending limits?

Yes. By identifying and removing invalid, disposable, and role accounts before sending, MailTester reduces your send volume and keeps you within limits.

Can I use MailTester with SendGrid or Mailchimp?

Yes. MailTester integrates with SendGrid, Mailchimp, HubSpot, and Klaviyo to verify lists before sending, reducing waste and improving deliverability.

Is there a free way to test email verification accuracy?

Yes. MailTester offers 100 free verifications to start, with no expiration on purchased credits.

How accurate is MailTester’s email verification?

MailTester achieves 98.9% accuracy by checking syntax, domain validity, and inbox reachability in real time.

Why would a valid email be flagged as risky?

It may be a disposable domain, a role account (e.g. admin@), or one associated with a known spam trap or high bounce rate.

Can catch-all emails be sent to?

Not reliably. Catch-all domains accept all messages, but recipients may never see them. They reduce deliverability and hurt sender reputation.

What’s the best way to maintain high inbox placement?

Clean your list, verify every address, avoid spam traps, and ensure consistent sending volume — all supported by MailTester’s verification tools.

Do MX records affect sending limits?

No. MX records route incoming mail but do not influence outgoing send limits set by Microsoft 365.