Two kinds of security change arrived in September 2025, and both land on the desks of IT and compliance teams. Microsoft announced that it would sharply limit email sent from the default .onmicrosoft.com domains that every Microsoft 365 tenant receives, closing off a route spammers and phishers had abused for years. At the same time, US lawmakers were working on information-sharing and sector-specific legislation aimed at supply-chain attacks, threats to agriculture and risks to critical infrastructure.

One is a vendor tightening its platform; the other is government changing the rules. Together they show attack surfaces extending well beyond traditional IT, into email reputation, supplier networks and even the food supply. This article explains each change, who it affects, and what to do about it.

Microsoft limits email from .onmicrosoft.com domains

Every Microsoft 365 tenant gets a default address ending in .onmicrosoft.com, known internally as the Microsoft Online Email Routing Address (MOERA). Because anyone can spin up a new tenant in minutes, attackers have long used these domains to send spam and phishing that borrows Microsoft’s reputation. That abuse degrades deliverability for every legitimate organization sharing the same domain namespace.

On September 2, 2025, Microsoft announced that mail sent from .onmicrosoft.com addresses would be throttled to 100 external recipients per organization in any rolling 24-hour period. Internal mail is unaffected. The limit is being phased in by tenant size, starting with trial tenants on October 15, 2025, and reaching the largest tenants, those with more than 10,000 seats, on June 1, 2026. Messages over the limit are rejected with a non-delivery report.

For most established businesses the fix is simple, but it is easy to miss something. What to do:

1. Find who still sends from .onmicrosoft.com. Use message trace in the Exchange admin center to identify mailboxes, shared mailboxes and applications sending externally from the default domain.
2. Check devices and applications. Scanners, line-of-business applications, monitoring alerts and scripts that relay through Microsoft 365 are common culprits, because they were configured once and forgotten.
3. Set a verified custom domain as the default and make it the primary SMTP address for affected mailboxes, keeping the old address as an alias.
4. Authenticate the custom domain properly with SPF, DKIM and a DMARC policy, which improves deliverability and makes your own domain harder to spoof.

Security teams should also treat inbound mail from unfamiliar .onmicrosoft.com senders with suspicion. The throttle limits volume, not intent, and targeted phishing needs only a handful of messages.

Information sharing in limbo: the CISA 2015 deadline

The Cybersecurity Information Sharing Act of 2015 gives companies legal protections, including liability shields and antitrust and disclosure safeguards, when they share cyber threat indicators with the federal government and with each other. It was enacted with a ten-year sunset, and as of September 2025 it was due to expire on September 30. Industry groups warned that without it, legal departments would restrict the sharing that helps defenders learn about new campaigns quickly.

For businesses, the practical point is that participation in sector information sharing and analysis centers (ISACs), and informal sharing with peers, depends on these protections. If you share threat data, have counsel confirm what protections apply and document your sharing practices so they can adjust quickly if the law changes.

Agriculture, food and the wider supply chain

Agriculture has become a visible target. The 2021 ransomware attack on meat processor JBS, which paid an $11 million ransom, showed how quickly an attack on one company can disrupt food supply. Farms and food processors now rely on connected equipment, automated irrigation and cloud-based logistics, often with small IT teams.

In February 2025 a bipartisan group reintroduced the Farm and Food Cybersecurity Act in both chambers of Congress. The bill would require the Department of Agriculture to periodically assess cyber threats to the food and agriculture sector and to run crisis simulation exercises with industry and government partners. Separately, lawmakers continued to press on foreign supply-chain risk, including scrutiny of network and connected equipment made by companies tied to foreign adversaries.

These efforts do not create new obligations for most private businesses yet, but they signal the direction: more expectation that suppliers are vetted, that critical sectors exercise their incident plans, and that threat information flows between companies and government. See our related article on industrial and critical infrastructure threats for the operational side.

What organizations should do now

• Review identity and domain management. Move off default domains, enforce SPF, DKIM and DMARC, and remove stale tenants, domains and application registrations.
• Track compliance changes deliberately. Assign someone to watch the vendor platform changes and legislation that affect you, and brief leadership quarterly. Platform changes such as Microsoft’s often come with hard deadlines.
• Build supply-chain resilience, digital and physical. Know which suppliers you depend on, what access they have, and how you would operate if one of them were disrupted.
• Join an information-sharing community. An ISAC or local peer group provides early warning that most small and mid-sized organizations cannot generate on their own.

Our cybersecurity compliance and regulatory framework services help organizations keep a single view of these obligations. For a related look at how regulation is moving, read Tech Regulations in Focus.

Update (September 2026): CISA 2015 lapsed on October 1, 2025, during the federal government shutdown. Congress restored it in November 2025 through January 30, 2026, and then extended it through September 30, 2026 in the Consolidated Appropriations Act enacted in early February 2026. As of this update it faces that deadline again, with long-term reauthorization still unresolved. Microsoft’s .onmicrosoft.com throttle was scheduled to reach tenants of all sizes by June 2026; check the Microsoft 365 Message Center for your tenant’s status.

Frequently asked questions

Does the Microsoft limit affect us if we already use our own domain?

Only for mail still sent from the .onmicrosoft.com address. Many organizations find a few shared mailboxes, service accounts or devices still using it, so run a message trace before assuming you are clear.

What is a MOERA domain?

It is the default yourname.onmicrosoft.com domain created with every Microsoft 365 tenant. It cannot be removed, but it does not need to be used for external email.

Is sharing threat information still safe for a private company?

Generally yes while CISA 2015 protections are in force, but because the law has been running on short extensions, confirm current status with counsel and share through established channels such as ISACs.

Staying ahead of policy changes

Delana Technologies helps organizations turn vendor and regulatory changes into clear action plans, from Microsoft 365 email and identity hardening to supply-chain risk programs. Call 239.414.5126 or contact us.

---

Sources: Microsoft Exchange Team, “Limiting Onmicrosoft Domain Usage for Sending Emails” (September 2025); Congressional Research Service, “The Cybersecurity Information Sharing Act of 2015: Expiring Provisions”; Hunton Andrews Kurth on the CISA 2015 extension through September 2026; S.754 and H.R.1604, Farm and Food Cybersecurity Act of 2025 (Congress.gov); US Department of Justice and JBS statements on the 2021 ransomware attack.