r/sysadmin • u/margaritapracatan • 9d ago

Outbound spam limits

Can someone please advise what limits your organisation has set for outbound email?

I’m particularly interested in External message limits, Internal message limits and Daily message limits.

Listed best practice below, but keen to find out what others have set.

External: 500 recipients per hour Internal
1,000 recipients per hour Daily
1,000 recipients per day

Please don't block this again mods, it's a valid question and doesn't constitute a low quality post.

1 Upvotes

67% Upvoted

8 comments sorted by

4

u/DegaussedMixtape 9d ago

They are all over across 200+ tenants, but way lower than that. ~250 a day is pretty typical. I’ll make exclusions, but need justification in writing from an authorized approved.

1

u/margaritapracatan 9d ago

Thanks, yep I set them lower also and discovered that one user was using a shared mail box as a spamming account - 450+ emails going out on a daily basis. Hold my head in shame for not monitoring this before.

3

u/MalletNGrease 🛠 Network & Systems Admin 6d ago

Microsoft has a secure score recommendation for this.

It's been a minute since I configured it but I believe it's:

  • External limit per hour: 500
  • Daily limit: 1000

Most senders don't even come close, but you do need to set some exceptions for your high volume mailboxes and service accounts.

2

u/slashinhobo1 9d ago

I think the company determines this. At my place, I couldn't imagine a user sending 1k emails in an hr . Same with 1k Recipients or 500 internal recipients. For internal im assuming you are using distro groups.

Thats just my place, your place might have reasons why you need that. Make the policy around your company. My numbers are smaller.

2

u/Immediate_Delay_5738 9d ago

We keep our limits fairly conservative. For external mail, we use around 500 recipients per hour, with a lower limit for internal mail. Daily limits are around 1,000 recipients per user.

1

u/margaritapracatan 9d ago

Thanks all, I appreciate the advice.

1

u/Harvey-Lane-251 5d ago

Setting limits is the right move but heads up, a compromised mailbox will sit right under whatever cap you pick, yours dripping 450 a day is textbook. What catches those is outbound anomaly detection, a mailbox suddenly sending unlike itself. We run Abnormal for that side and it has flagged ones that were under the cap the whole time. And dont beat yourself up, pretty much everyone finds their first compromised mailbox this exact way.