Exchange Online Protection limits

The following limits currently exist for Exchange Online Protection. These limits aren’t configurable unless specified otherwise.

Tip

For more information about limits in Exchange Online, see Exchange Online limits. The transport rule limits also apply to EOP standalone customers. The recipient rate and message rate limits for Exchange Online aren’t applicable for EOP standalone customers.

• Accepted domain limit - You can add up to 5000 accepted domains per tenant. Subdomains can be included in this 5000-limit, or if necessary, as part of a catch-all option, match subdomains. For more information, see Manage Accepted Domains in EOP.

• Remote domain limit - You can add up to 200 remote domains per tenant.

• Message size limit - The maximum message size for EOP standalone customers, including attachments, is 150 MB.

• Number of outbound messages sent - The limit for the number of outbound messages sent through EOP is high enough to ensure that normal email communication isn’t treated as spam. If you want to send commercial bulk email messages, rather than sending outbound messages through EOP, we recommend that you either use a third-party email service provider (ESP) or send them through your on-premises email servers.

• Recipient limit - As long as the sending host can split the message into "chunks" of fewer than 500 recipients, no explicit limit is defined. However, each "chunk" is effectively treated as a new message. Too many messages in a short period, messages from a host with a poor reputation, or messages with questionable content could be throttled or blocked.

• IP Allow or IP Block list limit - When configuring an IP allowlist or an IP blocklist in the connection filter, you can specify a maximum of 1273 entries, where an entry is either a single IP address or a CIDR range of IP addresses from /24 to /32.

• Message deferral limit - Messages in deferral will remain in our queues for 24 hours. Message retry attempts are based on the error type received from the recipient's mail system. Messages are retried every 15 minutes.

• Spam quarantine retention period - By default, spam messages sent to the quarantine are retained for 30 days. Administrators can lower this value via content filter policies.

• End-user spam quarantine notifications - By default, if enabled, end-user spam quarantine notifications are sent every 3 days. They can be configured to be sent every 1 to 15 days.

• Reporting and message trace limits - For reporting and message trace limits, see the "Reporting and message trace data availability and latency" section in Reporting and message trace in Exchange Online Protection.

Limits across EOP options

Feature	EOP Standalone	EOP features in Exchange Online	Exchange Enterprise CAL with Services
Domain limit	5000	5000	5000
Remote Domain limit	200	200	200
Message size limit (including attachments)	150 MB	150 MB	150 MB
Recipient limit	See "Recipient limit" above	500 recipients when sending from a hosted mailbox; see "Recipient limit" above for other scenarios	See "Recipient limit" above
Safe sender limit	1024 entries	1024 entries
Blocked sender limit per policy	1024 entries	1024 entries
IP allowlist or IP blocklist limit	1273 entries	1273 entries	1273 entries
Message deferral limit	1 day, retried every 15 minutes	1 day, retried every 15 minutes	1 day, retried every 15 minutes
Spam quarantine retention period	30 days by default but can be lowered	30 days by default but can be lowered	30 days by default but can be lowered
End-user spam quarantine notifications	3 days by default, configurable from 1 to 15 days	3 days by default, configurable from 1 to 15 days	3 days by default, configurable from 1 to 15 days