Daily limits on emails
IT Services have introduced daily limit on emails sent from Queen Mary accounts to help mitigate the impact of increased phishing attacks.
Sender limits are being introduced to reduce the risk posed by compromised email accounts while ensuring day-to-day university activity can continue smoothly.
New daily sending limits
- Student accounts: limit of sending to a total of 100 recipients per day
- Staff accounts: limit of sending to a total of 500 recipients per day
- Shared mailboxes: excluded from these limits as they are the standard route for official communications.
These changes have been introduced due to the increased scale and frequency of phishing attacks. A compromised account can send between 2,000 and 9,000 emails, often overnight or at weekends, which reduces the time available for our Security Operations team to intervene.
For the vast majority of students and colleagues, these limits should have no noticeable impact. If you have any questions, please contact the IT Service Desk.
FAQs
Please note: These measures aim to reduce risk while assisting students and staff in choosing the most suitable communication channels. Anyone who expects to reach the limit is encouraged to contact the IT Service Desk well in advance of any planned communication so that advice and exceptions can be offered.
Is the proposed limit based on the number of emails sent or the number of recipients?
The filter is based on recipients per email, so one email sent to 100 To/Cc/Bcc recipients counts as 100 emails towards the limit.
If we send via mail merge, will that count as individual emails?
Yes. Mail merge is counted per recipient, so each message counts separately towards the daily limit.
If we are sending via Bcc, does that count as one email?
No. Bcc recipients are counted individually, so an email sent to 450 people by Bcc is calculated as 450 emails.
If we send from QMplus as an announcement and select email, will that count as individual emails from that account?
QMplus and other systems messaging are excluded from the limits.
Are shared mailboxes, mailing lists, and system-generated emails included in scope?
No. Shared mailboxes, mailing lists, and system mailboxes are not in scope for this change and will remain unaffected. Automated sending should not be done from individual staff or student accounts, and support is available to help colleagues identify the most suitable route for large-scale communications.
Why were the proposed thresholds set at 100 for students and 500 for staff, and could they change?
The proposed thresholds were chosen by comparing overall sending volumes with patterns seen in compromised accounts. Based on recent analysis, a 500-recipient daily limit would have affected only a relatively small number of staff accounts, which means support and exceptions can be considered where needed. The thresholds can also be reviewed over time to ensure that they remain proportionate and workable in practice.
Do calendar invites also count as individual recipients?
Yes, the invitees also count as recipients.