Do not send mail from the onmicrosoft.com domain

Description

No mailbox, group or application sends mail with an address in the tenant's Microsoft Online Email Routing Address domain (<tenant>.onmicrosoft.com, MOERA). Every mailbox and group has its primary SMTP address in a custom domain, and the default domain of the tenant is a custom domain. The MOERA address stays as a secondary address, as Exchange Online requires.

Rationale

The onmicrosoft.com domains are shared by all tenants and their reputation is shared too. Recipients cannot tell a message from contoso.onmicrosoft.com from one sent by an attacker who created a look-alike tenant, and the organization's DMARC, DKIM and branding do not apply. Microsoft now limits outbound mail from MOERA domains to 100 external recipients per day per tenant; messages above the limit are rejected.

Impact

Accounts whose primary address changes keep receiving mail on the old address. Scripts, applications or devices that send as the MOERA address must be updated. Admin accounts without a mailbox are not affected.

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader. Browse to Settings > Domains and check that a custom domain is marked Default.
2. In Exchange Online PowerShell (read-only):

   Get-EXORecipient -ResultSize Unlimited | Where-Object { $_.PrimarySmtpAddress -like '*.onmicrosoft.com' } |
     Format-Table Name, RecipientTypeDetails, PrimarySmtpAddress
   Get-MessageTraceV2 -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date) -SenderAddress "*@<tenant>.onmicrosoft.com" |
     Group-Object SenderAddress | Select-Object Name, Count
   

3. Fail if a mailbox or group other than a documented system object has an onmicrosoft.com primary address, or if message trace shows outbound mail sent from the MOERA domain.

Remediation

1. In the Microsoft 365 admin center, Settings > Domains, select the main custom domain > Set as default (Domain Name Administrator).
2. For each listed user, Users > Active users > select the user > Manage username and email, add an address in the custom domain and set it as primary (User Administrator or Exchange Administrator). PowerShell equivalent:

   Set-Mailbox -Identity <user> -WindowsEmailAddress [email protected]
   Set-UnifiedGroup -Identity <group> -PrimarySmtpAddress [email protected]
   

   For synchronized users, change the mail / proxyAddresses attributes in Active Directory.
3. Update the scripts and devices that send as the MOERA address.

References

• Add or remove email addresses for a mailbox in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Exchange Online limits Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1076 - MOERA should not be used for sent mail Maester, tool, accessed 2026-10-24
• Maester MT.1074 - outbound mail sent with the onmicrosoft.com domain Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

People and lifecycle