Skip to main content

​
Two places limits can live

When you set a daily send limit in a cold email sequencer like Smartlead or Instantly, that limit is enforced by the tool. The tool counts emails sent in its own database and stops scheduling more when the cap is hit. TenantCore enforces limits differently. Limits are applied as Exchange Online transport rules policies that run inside Microsoft’s mail infrastructure, before a message is accepted for delivery.

​
How Exchange transport rules work

When a mailbox attempts to send a message, Exchange evaluates the message against a set of transport rules before processing it. TenantCore writes a rule for each mailbox that:
  1. Tracks the count of messages sent from that mailbox in a rolling 24-hour window
  2. Blocks delivery if the count exceeds the configured limit
  3. Returns a non-delivery report (NDR) to the sender
This happens at the protocol level. The sending tool never receives a success response for a blocked message — Exchange rejects it before it leaves the server.

​
Why this matters

Tool-level limits are enforced by software you control. Infrastructure-level limits are enforced by Microsoft.
Tool-level limitExchange-level limit
Enforced byYour sequencerMicrosoft Exchange
Bypassed by misconfigurationYesNo
Survives tool switchingNoYes
Visible to MicrosoftNoYes
If you switch sequencers, migrate campaigns, or run parallel tools against the same mailboxes, tool-level limits can be silently exceeded. Exchange limits cannot, they apply regardless of which tool is sending.

​
Setting and updating limits

Send limits are configured through the Set Global Limit button on your dashboard. This is an opt-in step that can be completed after mailboxes are provisioned — enforcement is not applied automatically. The flow lets you select a tenant, then choose to apply a limit to a specific domain, multiple domains, or all domains on the tenant at once. TenantCore then provisions a security group and transport rule in Exchange Online for each selected domain. Changes to send limits take effect within a few minutes. Exchange propagation for transport rule updates is typically under 5 minutes.

​
Scope

Limits are applied at the domain level, not per individual mailbox. Every mailbox under the selected domain inherits the limit. If you add a new domain after setting limits, you will need to run the Set Global Limit flow again for that domain — existing domains are not affected.

​
Updating limits

You can run the Set Global Limit flow at any time to increase or decrease the limit on any domain. This is how you manage your ramp schedule — start low across all domains and return to the flow periodically to raise the ceiling as your domains age and build reputation.

​
Why is email enforcement opt-in?

Different operators have different infrastructure needs. TenantCore does not impose a one-size-fits-all limit because the right ceiling depends on how your tenant is structured and how you are sending. An operator running 3 domains with a small number of mailboxes may want to push more volume per mailbox than the recommended 25 per day. That is a legitimate configuration and enforcement should not get in the way of it. The 25 email per mailbox per day limit becomes strategically significant at full scale. At 12 domains, 3 mailboxes per domain, and 25 emails per mailbox, a tenant produces exactly 900 emails per day. That number is deliberate — it sits below 10% of the TERRL for a 1-license tenant, which is 10,000 external recipients per day. Microsoft has powerful spam detection that operates at the tenant level, not just the mailbox level. Tenants sending more than 1,000 emails per day can trigger automated review and flagging even if no individual mailbox is behaving unusually. Staying at 900 keeps you well inside that boundary with meaningful headroom. If you choose not to set enforcement through TenantCore, the recommended approach is to keep total outbound volume across all domains and mailboxes on your tenant under 1,000 emails per day. That is the practical safe zone for a 1-license Microsoft 365 tenant before Microsoft’s tenant-level signals start to accumulate. See Understanding TERRL for a full breakdown of how Microsoft calculates and enforces tenant-level sending limits.

​
Enforcement events

Every time Exchange blocks a message due to a send limit, TenantCore logs an enforcement event. You can query the full audit log via the Enforcement API. Enforcement events are not errors, they indicate the system is working as intended. A spike in enforcement events may indicate a misconfigured campaign volume in your sequencer.