How many domains per Microsoft tenant for cold email

Microsoft 365 permits up to 900 domains on a single tenant. For cold email the correct number is one, and the gap between those two figures is the most consequential decision in a sending setup.

What happens when a domain burns

Cold email domains have a working life. Enough spam complaints, enough bounces into a spam trap, and receiving providers stop delivering mail from that domain. It is a normal end state, not a failure, and the plan should assume it.

The question is what else it takes with it. Reputation attaches to the domain, but enforcement does not stop there. A tenant producing sustained abuse can be restricted outright, and when that happens every domain on it stops sending, including the ones that were behaving.

One domain per tenant turns a burned domain into a contained loss. Ten domains per tenant turns it into a portfolio event.

The arithmetic of blast radius

The middle column is identical in every row, which is the point people miss when consolidating. Packing domains together saves nothing on the ordinary failure and multiplies the rare one.

The tenant sending limit

There is a second, quieter reason. Microsoft enforces a Tenant External Recipient Rate Limit, roughly 500 multiplied by licences to the power of 0.7, plus 9,500 external recipients per day, and it is shared across everything in the tenant.

That formula puts the floor near 10,000, which is not what we measured. On a tenant of our own with one domain and 100 mailboxes, refusals started every day once volume passed about 950 to 1,000 external recipients, on warm-up alone. We now budget about 900 a day per tenant, warm-up and campaign together, which one domain of 100 inboxes at 3 campaign and 5 warm-up sends fits under. A second domain on the same tenant does not. The detail is in the tenant sending limit post.

What one domain per tenant costs

Honestly stated: more. Each tenant carries its own licence, so ten domains across ten tenants costs ten licences rather than one. At $7 to $9 a tenant that is a real difference.

Against that, the mailboxes on a burned domain have to be rebuilt either way. What isolation buys is that only those mailboxes are affected, and the replacement domain goes onto a tenant that is already aged and ready rather than one you have to create and wait two weeks for.

The replacement cycle

This is where isolation pays for itself. A tenant outlives the domains on it. When a domain burns, you retire it, the tenant returns to the pool, and the next domain goes onto it immediately.

1. Domain burns and is retired
2. Its mailboxes are removed and the licence seat frees
3. The tenant returns to the pool, already aged
4. A replacement domain provisions onto it within a day

Compare that to the consolidated case, where a tenant-level restriction means standing up new tenants and waiting out the new-tenant rate limit before anything can send again.

When more than one is defensible

Two cases. First, transactional or internal mail that is not cold outreach, which carries none of the same risk and can share a tenant freely. Second, a short test where you are measuring something and accept that a bad result costs the whole tenant.

For production cold email at any volume worth protecting, one domain per tenant is the configuration, and holding spare aged tenants in a pool is what makes replacement fast. That pool model is how our agency provisioning is structured, for exactly this reason.