Emails received via an exchange api call have supposedly invalid email address from "fromEmail"

Question

Hi ,

 We have a customer who connected an account using our application. In our logs we noticed for some of the emails the fromEmail addresses that we receive are more than 255 character long. We are curious on two things.
```1. Are these invalid emails. Some of the one posted below dont look as email address at all

1. Does outlook exchange server reject emails from such sources.

E.g. 

<Removed PII>

Answer 1

Hi @dumbrerohit,

Welcome to Microsoft Q&A, and thank you for reaching out.

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Based on your description, from my research, your understanding is correct.

The value you provided does not appear to be a valid email address. SMTP standards require email addresses to follow a strict user@domain format and to be no longer than 255 characters. The string in your example looks more like tracking data or application‑generated metadata, rather than an actual sender mailbox, and is therefore considered invalid.

For an email to be treated as valid, any tracking IDs, signatures, or other metadata must be kept outside of the email address itself. The sender mailbox should remain under 255 characters and conform to the standard user@domain format as mentioned earlier.

Regarding whether Exchange will reject emails from such a source, that is correct. As I checked, both Exchange Online and Exchange Server enforce strict validation of the From address as part of their anti‑spoofing and anti‑phishing protections. Microsoft requires inbound messages to contain an RFC‑compliant From address, and messages with malformed or non‑standard sender values may be rejected during mail flow processing.

For reference:

How Microsoft 365 validates the From address to prevent phishing - Microsoft Defender for Office 365

Exchange Server non-Compliant P2 FROM header detection | Microsoft Learn

I hope this helps.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.