Microsoft’s Next Hit At Recruitment Email

From TERRL to MERRL: Recruiters Beware

First came TERRL, the Tenant External Recipient Rate Limit. Microsoft introduced it quietly, limiting how many external recipients your Microsoft 365 environment can contact in a 24-hour period. It scales based on your licence count, but it still feels random when emails fail without warning.

Now comes MERRL. This time the restrictions hit individual users and for some, this is really gonna hurt.

MERRL stands for Mailbox External Recipient Rate Limit. Starting in late 2025, Microsoft will enforce a new cap: no mailbox can send to more than 2,000 external recipients in any 24-hour rolling window. This affects all licensed user mailboxes in your organisation.

If you are in recruitment and use tools that send through 365, this change is going to disrupt your outreach significantly.

What Is MERRL and When Does It Apply

MERRL is Microsoft’s way of saying that Exchange Online is no longer to be used for campaign-style or high-volume external messaging. The limit applies regardless of how emails are sent. Whether you use Outlook, third-party tools, shared mailboxes, or automated sequences, every external recipient counts toward the cap.

Here is the rollout timeline as announced by Microsoft:

Date	Enforcement Scope
October 2025	Applies to all newly created Microsoft 365 tenants
October 2025 to March 2026	Phased rollout to existing tenants
April 2026	Full enforcement across all Microsoft 365 tenants worldwide

This means existing recruitment firms using Microsoft 365 have some time, but not much. This is the window to prepare, test, and fix your processes.

It Is Not 2,000 People, It Is Every Send to Every External Address

MERRL counts total external recipient events, not unique people. If you email the same 100 candidates five times in one day, that counts as 500 against your limit.

Follow-ups, nurture sequences, interview reminders, and business development drip campaigns all contribute. If your systems or recruiters send anything external, each of those messages is tracked individually.

Example Volume

Ten recruiters Each with five active sequences Ten recipients per sequence Three steps sent in a day

That already creates 1,500 recipient events, without accounting for newsletters or shared mailbox use. And since MERRL uses a rolling 24-hour window, sending limits reset hour by hour, not at midnight.

Shared Mailboxes Are Not a Workaround

Many firms use shared mailboxes like jobs@ or hello@ to distribute communication, assuming they are exempt from sending restrictions. That is incorrect.

If a recruiter sends from a shared mailbox using delegated access, the recipient count is applied to the recruiter’s personal mailbox limit
If a tool or app accesses the shared mailbox directly (via SMTP or Graph), the shared mailbox has its own 2,000 recipient limit
If the shared mailbox is unlicensed and used for high-volume email, Microsoft may throttle or block it entirely

This is not theoretical. It is how Microsoft is treating mailbox identity today. Shared mailboxes must be managed carefully under MERRL, but more on that here.

What Happens When You Hit the Limit

Emails to external addresses stop being delivered
CRM and outreach tools fail silently or generate hard-to-interpret errors
Candidates and clients go uncontacted mid-sequence
Your domain reputation suffers from failed sends and retry loops
Your team loses hours trying to work around invisible blocks

There is no warning. Once the 2,000 mark is hit, your mailbox is effectively silenced externally until earlier sends fall outside the 24-hour window.

What You Can Do Now to Prepare

1. Audit Who Sends What and From Where

Identify every tool and person sending email using Microsoft 365 credentials. That includes:

Direct Outlook users
CRMs using SMTP or Graph
Automations or custom scripts
Shared mailbox activity

Get clarity on the true scope of your outbound messaging.

2. Understand Your Overall Volume and Risk Level

To get an idea of your overall volume, tools like Quinset Powermail offer DMARC-based visibility across all platforms sending email on your behalf. While Powermail does not show mailbox-specific counts, it reveals:

Total volume of email sent from each platform or service
Which tools are active that you may not even know about
When your sending volume is trending toward dangerous levels

This lets you see where your risk is growing, and where mail is being sent from in your domain.

2. Check Each Mailbox For Volume

Unfortunately, Microsoft does not yet offer a built-in report for mailbox-level MERRL usage. However, there are options:

Use PowerShell message trace commands to count outbound external recipients per user
If you use Microsoft Defender for Office 365, you can filter message reports by recipient type

Microsoft has announced that a new report will arrive in the Exchange Admin Center later in 2025 to track outbound external usage per mailbox.

3. Review and License Shared Mailboxes

If you are using shared mailboxes for any kind of automation or campaign messaging, they might need to be licensed and treated like user mailboxes. Otherwise, Microsoft may block their sending or count their volume against users in unpredictable ways.

This can also be handy as it increases the number of licences you have, upping your TERRL limit.

4. Move Outreach Off Exchange Online

Microsoft has made it clear. Their words on this:

Exchange is for person-to-person communication, not mass communication.

So, what does this mean?

Move campaign-style traffic to Azure Communication Services or platforms like SendGrid and Mailgun
Use CRMs that send through their own infrastructure
Segment transactional vs campaign traffic

The goal is to separate your one-to-one candidate and client communication from the high-volume work that will soon be blocked.

5. Pressure Your Vendors for MERRL Awareness

Ask your email and CRM providers:

Does their platform enable you to send from another platform (SendGrid, Mailgun, Postmark, etc)?
Does their platform track or manage the new 2,000 external recipient limit?
If your stuck with sending out through 365 right now, do they have a plan

Do they even know what you are talking about when you bring this up? You may need to rethink your tool stack before you get affected.

TL;DR

Microsoft is enforcing new rules that dramatically limit how much email your recruiters can send to external contacts.

MERRL limits each licensed Microsoft 365 user to 2,000 external recipients per 24 hours
This includes every send, even if it is the same person multiple times
Shared mailboxes do not protect you and may be silently blocked
Rollout begins October 2025 for new tenants, with full enforcement for all by April 2026
If you hit the limit, external emails stop with no warning
You must audit, monitor, and potentially move campaign traffic off Microsoft 365