5.2.2 Bounce: Mailbox Full or Submission Quota Exceeded?

A 5.2.2 bounce means one of two different things, and the difference decides what you do. In the standard (RFC 3463), 5.2.2 means mailbox full: the recipient is over a storage quota, so the address is real but cannot take mail at the moment. In Exchange Online, Microsoft's own documentation lists 5.2.2 as "Submission quota exceeded": the sender, which may be you, went over a recipient or message rate limit. In the first case, look at the address. In the second, look at your own sending account. SimpleVerifier Pro helps with the part you can control, which is sending to fewer dead addresses: $39 a month, the first 100,000 checks a month at full speed, then slower, never cut off, with 100 free checks.

Meaning one: the recipient's mailbox is full

RFC 3463 defines the X.2.2 status as "mailbox full": the mailbox is full because the user has exceeded a per-mailbox administrative quota or physical capacity. The recipient can usually fix it by deleting messages. The RFC treats it as a persistent transient failure, which means it can clear. Even so, many servers send it as a 5xx reply.

Typical wording:

552 5.2.2 Requested mail action aborted: exceeded storage allocation
552 5.2.2 <name@example.com>: Recipient address rejected: mailbox full

What it tells you: the mailbox exists. It is not a bad address in the typo sense. But a mailbox that is permanently full is usually abandoned, which is a different kind of problem, and a poor target for email. For a dedicated treatment see our reference page at /smtp/552-5-2-2.

What to do

• Once: do not delete the address on one bounce. Retry on your next normal send.
• Repeatedly: if it comes back on three separate sends over a few weeks, suppress it. A mailbox that stays full is an unmonitored mailbox.
• Do not hammer it. Repeatedly refused sends add bounces to your record and gain nothing.

Meaning two: you exceeded Exchange Online's submission quota

Microsoft's Exchange Online nondelivery report page, which we read on 10 November 2026, lists:

5.2.2: Submission quota exceeded. The sender exceeded the recipient rate limit or the message rate limit as described in Sending limits.

Microsoft adds that this error could indicate the account was compromised and is being used to send spam, and points to its guidance for responding to a compromised account. Here the recipient mailbox is irrelevant. The refusal is about your sending volume.

How it looks different from mailbox full:

	Mailbox full	Submission quota exceeded
Whose limit?	Recipient's storage	Your account's sending limit
How many bounce?	One address	Many recipients in a burst
Where do you see it?	Any sender	You send from Microsoft 365 / Exchange Online
What to check	The address's history	Your account's volume and security

If you run cold email from Microsoft 365 mailboxes, this second meaning is the one that matters to you. Our guide to Microsoft 365 SMTP auth for cold email explains how those mailboxes are set up, and bounce budgets per inbox shows how to keep each inbox well inside its limits.

What to do

1. Stop sending from that mailbox. Do not retry in a loop.
2. Check the account is not compromised. Microsoft says this error may indicate that. Look at sent items for messages you did not send, and check sign-in activity.
3. Look at your limits. The limits are published in Microsoft's Exchange Online service description. Compare your daily and per-minute volume with them, and spread sends across more mailboxes rather than pushing one harder.
4. Cut waste. Every recipient in your send counts against the limit, including addresses that were going to bounce. Removing invalid addresses before you send lowers the count.
5. Resume small. Restart at a fraction of the earlier volume.

How to tell which one you have, in a minute

1. Read the full text. Storage, mailbox, quota exceeded for the recipient: meaning one. Rate limit, sending limits, recipient rate: meaning two.
2. Check the scope. One address among a successful batch is meaning one. A run of different recipients all at once is meaning two.
3. Paste it into the bounce message analyzer if you are unsure.

A worked example

Say a cold email campaign goes out from one Microsoft 365 mailbox and, within the first hour, a run of bounces comes back reading submission quota exceeded. The recipients are unrelated: different companies, different providers. That pattern says the limit is yours. The sensible response is to stop that mailbox, check sent items and sign-in activity, and restart at a lower volume spread over several mailboxes.

Now say instead that a campaign finishes normally and, a day later, two addresses out of a few hundred return a mailbox full message. Those are the recipients' mailboxes. Leave them for the next send, note them, and suppress them only if they come back the same way on separate sends. Two different events with the same number, and two opposite responses. This is why reading the text and the scope of the bounce matters more than the code on its own.

Where verification helps and where it does not

Be clear about this, because it is easy to oversell. A mailbox that is full usually still accepts the address at the front door, and only refuses delivery of the message itself. So a verifier cannot promise to flag full mailboxes, and a full mailbox may show up as valid or risky. If you want to read how providers behave at the point of the check, see how mailbox providers answer verification checks.

What verification does well, and what matters for both meanings of this code:

• It removes addresses that do not exist and domains with no working mail servers, which are the largest source of avoidable bounces.
• It keeps those dead recipients out of your send, so you spend less of your sending limits and your bounce rate stays down.
• It labels uncertain addresses as risky so you can test them in small batches.

For the quota problem specifically, fewer wasted recipients means more of each mailbox's daily limit goes to real people.

Check a single address with the free email checker, or batch a file at /verify. For older lists, removing repeat soft bounces shows how to retire addresses that keep failing, including full mailboxes.

How SimpleVerifier fits

SimpleVerifier Pro is $39 a month. The first 100,000 checks a month run at full speed, then slower, and you are never cut off. Try 100 free checks, no card, before you decide. See pricing.

What not to do

• Do not raise your volume because a 5.2.2 came back. If it is the quota kind, you are already over.
• Do not delete a mailbox-full address after one bounce. Give it a few separate attempts.
• Do not assume the bounce is about the recipient when many different recipients bounce in one burst.
• Do not skip the account check. Microsoft flags compromise as a possible cause.

Bottom line

5.2.2 is a number with two jobs. For recipients it says mailbox full: wait, then suppress if it persists. For Microsoft 365 senders it says submission quota exceeded: stop, check the account and cut volume. Cleaning invalid addresses out before you send lowers both your bounce count and your use of sending limits. The soft bounce handling guide is a good next read, and the 100 free checks on /verify show how many addresses you can drop.