Exchange Online Protection limits
The following limits currently exist for Exchange Online Protection. These limits aren’t configurable unless specified otherwise.
Tip
For more information about limits in Exchange Online, see Exchange Online limits. The transport rule limits also apply to EOP standalone customers. The recipient rate and message rate limits for Exchange Online aren’t applicable for EOP standalone customers.
Accepted domain limit - You can add up to 5000 accepted domains per tenant. Subdomains can be included in this 5000-limit, or if necessary, as part of a catch-all option, match subdomains. For more information, see Manage Accepted Domains in EOP.
Remote domain limit - You can add up to 200 remote domains per tenant.
Message size limit - The maximum message size for EOP standalone customers, including attachments, is 150 MB.
Number of outbound messages sent - The limit for the number of outbound messages sent through EOP is high enough to ensure that normal email communication isn’t treated as spam. If you want to send commercial bulk email messages, rather than sending outbound messages through EOP, we recommend that you either use a third-party email service provider (ESP) or send them through your on-premises email servers.
Recipient limit - As long as the sending host can split the message into "chunks" of fewer than 500 recipients, no explicit limit is defined. However, each "chunk" is effectively treated as a new message. Too many messages in a short period, messages from a host with a poor reputation, or messages with questionable content could be throttled or blocked.
IP Allow or IP Block list limit - When configuring an IP allowlist or an IP blocklist in the connection filter, you can specify a maximum of 1273 entries, where an entry is either a single IP address or a CIDR range of IP addresses from /24 to /32.
Message deferral limit - Messages in deferral will remain in our queues for 24 hours. Message retry attempts are based on the error type received from the recipient's mail system. Messages are retried every 15 minutes.
Spam quarantine retention period - By default, spam messages sent to the quarantine are retained for 30 days. Administrators can lower this value via content filter policies.
End-user spam quarantine notifications - By default, if enabled, end-user spam quarantine notifications are sent every 3 days. They can be configured to be sent every 1 to 15 days.
Reporting and message trace limits - For reporting and message trace limits, see the "Reporting and message trace data availability and latency" section in Reporting and message trace in Exchange Online Protection.
Limits across EOP options
| Feature | EOP Standalone | EOP features in Exchange Online | Exchange Enterprise CAL with Services |
|---|---|---|---|
| Domain limit |
5000 |
5000 |
5000 |
| Remote Domain limit |
200 |
200 |
200 |
| Message size limit (including attachments) |
150 MB |
150 MB |
150 MB |
| Recipient limit |
See "Recipient limit" above |
500 recipients when sending from a hosted mailbox; see "Recipient limit" above for other scenarios |
See "Recipient limit" above |
| Safe sender limit |
1024 entries |
1024 entries |
|
| Blocked sender limit per policy |
1024 entries |
1024 entries |
|
| IP allowlist or IP blocklist limit |
1273 entries |
1273 entries |
1273 entries |
| Message deferral limit |
1 day, retried every 15 minutes |
1 day, retried every 15 minutes |
1 day, retried every 15 minutes |
| Spam quarantine retention period |
30 days by default but can be lowered |
30 days by default but can be lowered |
30 days by default but can be lowered |
| End-user spam quarantine notifications |
3 days by default, configurable from 1 to 15 days |
3 days by default, configurable from 1 to 15 days |
3 days by default, configurable from 1 to 15 days |