🔹 Introduction
As an Exchange Server administrator, one of the key ways to protect your environment from misuse or accidental spam is to limit how many recipients a user can send an email to at once. This helps avoid internal spam, reduces the risk of phishing, and improves server performance.
In this post, I’ll walk you through how I implemented a policy that limits users to a maximum of 20 recipients per message, and how I monitor and enforce this behavior using PowerShell and Exchange settings.
🔹 Why Limit Recipient Count?
- ❌ Prevent accidental or intentional bulk mail
- 🛡️ Protect internal users from spam
- 🔐 Reduce impact of compromised accounts
- 📈 Improve mail flow efficiency
🔹 Step 1: Set Org-Wide Recipient Limit
To enforce a global maximum recipient limit across the organization:
Set-TransportConfig -MaxRecipientEnvelopeLimit 20
You can verify it with: Get-TransportConfig | Select MaxRecipientEnvelopeLimit
🔹 Step 2: Ensure Mailboxes Inherit the Limit
By default, mailboxes can override this setting. To force them to use the global value, clear any custom RecipientLimits:
Get-Mailbox -ResultSize Unlimited | Set-Mailbox -RecipientLimits unlimited
Exception: If some users send above limits, can change limit for specific mailboxes from ECP.
🔹 Step 3: Set Send Connector Limit (Optional)
If you’re using a send connector for internet email:
Set-SendConnector -Identity "YourConnectorName" -MaxRecipientsPerMessage 20
🔹 Step 4: What Happens When Limit is Exceeded
If someone tries to send an email to more than 20 recipients (To + Cc + Bcc):
- The message will fail to send
- The sender will receive an NDR (non-delivery report)
- Example error:
Remote Server returned '550 5.5.3 RESOLVER.ADR.RecipLimit; too many recipients'
Note: Distribution Groups count as 1 recipient unless expanded. Hence, mail send successful.
🔹 Step 5: Monitor and Alert on Violations
Here’s a script I use to detect violations and send an alert:
🔹 Conclusion
Enforcing recipient limits is a simple but powerful way to harden your mail system and avoid user mistakes. Combined with regular monitoring, this gives you full control over outbound mail behavior in Exchange Server.
