X DM limits, and what automated DMs can actually do

There are two DM limits on X. The one on the help page is 500 messages a day, and almost nobody running outreach gets near it. The one that actually stops a campaign is who you are allowed to message in the first place, and the recipient sets that, not you.

The official DM limit: 500 a day

X (formerly Twitter) publishes one number for direct messages. The limits page at help.x.com/en/rules-and-policies/x-limits (checked 19 September 2026) says, verbatim: "Direct Messages (daily): The limit is 500 messages sent per day." Two more lines on that page matter. "These limits include actions from all devices, including web, mobile, phone, API, etc.", so the app and a browser draw on the same 500. And: "These limits may be temporarily reduced during periods of heavy site usage."

There is no per-hour or per-fifteen-minute figure; the smaller numbers on tool blogs are not on the help page, and X does not publish the threshold at which a run of messages becomes spam. The 500 is a technical limit, not a safe one. The full table of published limits is in X rate limits.

Read-only mode shrinks the limit to your followers

One account state changes the number. The enforcement page at help.x.com/en/rules-and-policies/enforcement-options describes read-only mode: "We may temporarily limit an account's ability to post, Repost, or Like. The user can read their timelines and will only be able to send Direct Messages to their followers." For an outreach account that is almost nobody on the list, and the page gives no duration.

The wall nobody mentions: who you can message at all

The limit that ends most campaigns is not a count. It is the recipient's settings. X's automation rules list the ways a person is technically reachable: they follow you, they have "enabled the ability to receive Direct Messages from any account", or they are already in a conversation with you. Someone with none of those cannot be sent a first message, by you or by any tool.

On the cold lists we have run, roughly a quarter of the handles were unreachable before any warming. That is our fleet and our lists; your topic will move the figure. Screen for that slice up front.

The follow relationship is the lever. Observed directly in our campaigns: a sending account that could not message a target followed them, the target followed back, and the verdict flipped from cannot to can. That is why a DM bot warms before it sends. The follow side has limits and rules of its own, covered in X follow bots and follow limits.

What X's rules say about automated DMs

This is quoted rather than paraphrased, because people soften it. The automation rules page at help.x.com/en/rules-and-policies/x-automation (the page says "Updated April 2026") states: "You may not send unsolicited Direct Messages in a bulk or automated manner." It then closes the door most outreach tools lean on: "The fact that a user is technically able to receive a Direct Message from you (e.g. because the user follows you, has enabled the ability to receive Direct Messages from any account, or because the user is in a pre-existing Direct Message conversation with you) does not necessarily mean they have requested or expect to receive automated Direct Messages from you." And on follow-ups: "After a user-initiated interaction ends, don't send additional follow-up Direct Messages or mention users in a post unless you get permission from the user."

Read plainly, a cold DM campaign, a template sent to people who did not ask to hear from you, is the behaviour this rule describes. A follow-back is not consent either; the page names following you as something that does not count. This article does not claim otherwise, and neither does the product it sits on.

Two more lines on the same page apply to any bot that drives the website rather than the API: do not "Use non-API-based forms of automation, such as scripting the X website. The use of these techniques may result in the permanent suspension of your account." And: "For X users: You are ultimately responsible for the actions taken with your account, or by applications associated with your account." The API against a real browser is weighed in what X automation can actually do.

What a DM bot can actually do

Strip the marketing off a mass DM tool and what remains is bookkeeping. The tool cannot make an unreachable person reachable, cannot lift a message out of the requests folder, and cannot stop a recipient reporting it. In flottra a campaign is a message template, a list of handles, a set of sending accounts and a pace, and it runs in this order:

Nothing in that sequence replies, quote posts or mass likes; the warm-up is a follow and a couple of likes because that is the smallest action observed to change reachability.

Pacing that survives

The 500 is irrelevant to pacing. An account that sent 500 messages in a day would be describing a call centre, and X does not need a published rule to notice. flottra's default cap is 3 direct messages per hour per sending account, a ceiling rather than a target, with the campaign's own daily limit and window underneath it. Four things matter more.

• Random gaps, drawn fresh for every send. Twenty messages exactly four minutes apart are a more obvious machine than twenty spread unevenly across an afternoon. A fixed interval is itself a pattern, and the cheapest to detect: it needs only a clock.
• A window on the account's own clock. An account whose proxy sits in one country and whose messages go out at 03:00 there is contradicting itself. The window follows the proxy's location, not the machine's; see choosing proxies for X accounts.
• One message per person, ever. The target is claimed before the send, so a retry after a failure cannot message the same person twice. After three attempts the target is marked failed, not tried again tomorrow.
• A campaign limit chosen from the account, not from the ceiling. The honest input is the sending account's age. The three week warming ramp in why X accounts get suspended contains no direct messages at all; messaging is the last thing a new account should learn.

What gets sending accounts actioned

X does not publish detection rules for messaging. What follows is what has been observable from watching outreach accounts fail.

• Identical templates across accounts. Ten accounts sending the same paragraph with the name swapped are linked by the text alone. Write the template per sending account and keep it short; this is real work, not a setting.
• A link in the first message. A URL from a stranger is what spam looks like to the person receiving it, and that person is who reports it. The link goes in the second message, if there is one.
• A burst of requests from a young account. An account created last week whose first act is forty message requests to strangers is describing exactly what it is. Age it, ramp it, and let messaging come last.
• Reports. The one that matters most, and the one you cannot pace away. Perfect gaps, a clean proxy and a persistent profile do nothing about a recipient who did not want the message and said so. The only lever is the list and the text.

What a reply rate looks like

There is no honest percentage to give. Reply rates depend on the list, the topic, the text and how many messages ever left the requests folder. What can be said is structural: most cold DMs are never opened, because they land in requests, and a reply is the only outcome you can measure from outside. That is why the inbox sweep is part of the sequence: a reply surfaces within seconds, the target is marked replied and not messaged again, and what happens next is a person's job. A second automated message into a thread the other person opened is what the follow-up rule prohibits.

Running this from several accounts

Everything above is manageable by hand for one account and fifty targets. At ten accounts and two thousand targets, the parts that matter are the boring ones: who has already been messaged, who came back unreachable, and which account was locked an hour ago and must not send. That bookkeeping is the product in this category. flottra keeps the campaign in a panel and runs each sending account in its own Chrome window on your own computer through your own proxy. It does not make an unwanted message wanted, and it does not promise that a sending account survives.

1. Screen the list before anything is sent; a quarter of it may be unreachable.
2. Give every sending account its own proxy and persistent browser profile, with its window on the proxy's clock. See whether you need an antidetect browser.
3. Warm with a follow and a like or two, wait hours, then send.
4. One message per person, uneven gaps, a campaign limit set from the account's age, no link in the first message.
5. Measure replies rather than sends, and stop automating the moment a person answers.

Do those five and what remains is the part no tool solves: whether the people on the list wanted to hear from you. The reports come from there, and the reports decide how long the accounts last.