Microsoft 365 550 5.7.233 / 5.7.232: tenant exceeded its daily limit for external recipients (TERRL)

Short answer: Your whole Microsoft 365 organisation sent to more outside recipients in the last 24 hours than its quota allows, so external mail is blocked until the count drops. Fix: wait, look for a hacked mailbox or a bulk send, and move newsletters and app mail to an email sending service.

The bounce looks like this
550 5.7.233 Your message can't be sent because your tenant exceeded its daily limit for sending email to external recipients (tenant external recipient rate limit).
550 5.7.232 Your message can't be sent because your trial tenant has exceeded its daily limit …

What it means

Exchange Online caps how many external recipients (addresses outside your own domains) the whole organisation can send to in a rolling 24 hours: the Tenant External Recipient Rate Limit (TERRL). Once it is reached, everyone gets this bounce for outside recipients; internal mail keeps working. The quota grows with purchased licences – 500 × licences^0.7 + 9,500, so 10,000 a day for one licence, about 12,000 for 10 and 22,000 for 100 – and each external member of a distribution group counts separately. Trial tenants get 5.7.232. In a rollout due to finish by the end of November 2026, Microsoft is cutting the trial quota from 5,000 to 500 a day and giving tenants younger than 31 days 10% of the normal quota (25% up to 60 days).

How to fix it

  1. See where you stand: Exchange admin center → Reports → Mail flow → Tenant Outbound External Recipients shows the daily quota, current usage, blocked recipients and whether enforcement is on.
  2. Wait: the window is rolling, so external mail flows again by itself once the last 24 hours drop below the quota. Bounced messages are not retried – resend the important ones after that.
  3. Rule out a hacked account: a sudden jump usually means a mailbox is sending spam. Check Restricted entities and the Email sending limit exceeded alert in the Microsoft Defender portal and run a message trace; reset the password and turn on MFA for anything suspicious.
  4. Find the big senders: mail merges, newsletters, CRM or app notifications sent from Microsoft 365 mailboxes, and messages to distribution groups with many outside members.
  5. Move bulk and automated mail off Exchange Online to an email sending service (Amazon SES, Postmark, Brevo), ideally from a subdomain, and set up its SPF and DKIM with the setup guides. Microsoft's pages still mention Azure Communication Services Email, but it is being retired on 30 September 2028.
  6. Need more headroom on Microsoft 365 itself? The quota only rises with purchased licences; a trial tenant moves to the normal formula once it has paid licences.
  7. After moving senders, check your domain below: every new service has to be in your SPF record and sign DKIM with your domain.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Other bounce errors