# Instagram DM Limits (2026): Every Number, Sourced

> Instagram's real DM limits, with sources: the 24-hour messaging window, the one-private-reply-per-comment rule, 750 private replies/hour, Meta's API rate-limit formulas, and the undocumented soft clamp. No recycled myths.

Reference guide

# Instagram DM limits in 2026:  
every number, with its source

Most articles about Instagram DM limits repeat numbers nobody can trace. This page is different: every limit below comes from Meta's developer documentation or from our own operating experience running DM automation on the official API — and we tell you which is which.

Updated August 2026 · Human-verified

[Try Reachlee free ](/app/)[Is DM automation allowed?](/instagram-dm-automation/is-it-allowed/)

Official Meta API · every claim sourced · updated August 2026

## The honest answer, in 100 words

Instagram messaging limits come in three layers. Layer 1 is the 24-hour messaging window: a business can only free-form message a user within 24 hours of that user's last message (Meta policy). Layer 2 is the private-reply rule: one DM reply per comment, within 7 days of the comment (Meta policy). Layer 3 is API rate limiting: formula-based per-account and per-app call budgets (technical). Meta does not publish a simple 'X DMs per day' number for API sends. The viral '200 DMs per hour' figures circulating online describe manual sending or unofficial automation — not the official Instagram Messaging API.

1There is no official 'X DMs per day' cap — Meta rate-limits API sends by formulas and error codes, not a daily number

2The 24-hour window is policy: free-form DMs only within 24h of the user's last message to you; automation can never message first

3Private replies to comments: exactly one DM per comment, within 7 days of the comment (posts/reels), capped at 750 private replies per hour per account

4The Send API itself allows up to 300 text-message calls per second per Instagram professional account — throughput is not the real constraint, policy is

5Rate-limit state is exposed in response headers (X-App-Usage, X-Business-Use-Case-Usage) with an estimated\_time\_to\_regain\_access field in minutes

6There is also an undocumented soft clamp: sends can start failing with generic errors and no recovery estimate — reputable tools back off; unofficial tools push through and get accounts flagged

## Layer 1 — the 24-hour messaging window (policy)

Meta's Instagram Messaging documentation states it plainly: 'Your app has 24 hours to respond to any message sent from an Instagram user to your app user.' Two rules follow from this. First, a business (or any tool acting for it) can never initiate a conversation — per Meta, conversations only begin when the Instagram user messages the business first, via DM, story reply, story mention, or similar. Second, once a user does take a messageable action, the business may send free-form messages (text, links, media it owns) only within 24 hours of that action. Outside the window, the only sanctioned path is the HUMAN\_AGENT message tag, which extends the response window to 7 days — but it requires explicit approval through Meta App Review and is intended for human escalation, not automated campaigns. Promotional content outside the window without an applicable tag is not allowed at all.

* Opens or refreshes the window: the user DMs the business, replies to a story, reacts to a story, mentions the business in a story, or taps a postback button in an existing conversation
* Does NOT open the window: a comment on your post by itself, or a tap on a web-link button — neither is a message to you
* A private reply to a comment does not open the 24h window either — it's a one-shot (see Layer 2)
* Other hard constraints from the same doc: text messages max out at 1,000 bytes of UTF-8, group messaging is not supported, and media you send must be owned by the business account

## Layer 2 — private replies to comments (policy)

Private replies are the mechanism behind every 'comment a keyword and I'll DM you' automation: the API lets a business send a DM to someone who commented on its post or reel. Meta's rules here are specific. You get exactly one private reply per comment — ever. It must be sent within 7 days of the comment's creation (for posts and reels; live-broadcast comments can only be replied to during the broadcast). And the rate cap is 750 private replies per hour per Instagram professional account, per Meta's rate-limiting documentation. This is why a well-built tool will refuse to DM the same comment twice, and why comments older than a week silently stop converting: that's not a bug in the tool, it's the tool complying. Any product that claims it can re-DM the same comment or reach back to month-old comments is either lying or operating outside the official API.

* One private reply per comment — a hard Meta rule, not a tool limitation
* 7-day window from comment creation for posts and reels
* 750 private replies per hour per account (Reachlee enforces a lower internal ceiling of 600/hour to keep headroom)
* Live-story comments: replies only while the broadcast is live
* The private reply itself does not grant a 24-hour conversation window — follow-up free-form DMs still require the user to message you

## Layer 3 — Meta's documented API rate limits

| Limit                                        | Documented value                                                                                                                 | Where Meta states it                                             |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| Send API — text, links, reactions, stickers  | Up to 300 calls/second per Instagram professional account (some doc tables list 100/sec — treat 100 as the conservative reading) | Graph API rate-limiting doc, Messenger API for Instagram section |
| Send API — audio / video messages            | 10 calls/second per Instagram professional account                                                                               | Graph API rate-limiting doc                                      |
| Private replies (post/reel comments)         | 750 calls/hour per Instagram professional account                                                                                | Graph API rate-limiting doc                                      |
| Private replies (live comments)              | 100 calls/second, during the broadcast only                                                                                      | Graph API rate-limiting doc                                      |
| Conversations API (reading threads)          | 2 calls/second per Instagram professional account                                                                                | Graph API rate-limiting doc                                      |
| Instagram platform total (Business Use Case) | Calls within 24 hours = 4,800 × number of impressions (impressions floor of 10)                                                  | Graph API rate-limiting doc                                      |
| Per-app platform tier                        | Calls within one hour = 200 × number of daily active users of the app                                                            | Graph API rate-limiting doc                                      |

All values as of August 2026, from https://developers.facebook.com/docs/graph-api/overview/rate-limiting — Meta can change them at any time. Notice what's absent: there is no 'DMs per day' row, because Meta doesn't define one. Daily-cap numbers you see elsewhere are inferred, self-imposed by tools, or about manual sending.

## How Meta actually enforces these limits

Meta doesn't just reject call number N+1\. Every Graph API response carries usage headers, and well-behaved tools read them continuously. The X-App-Usage header reports the app's rolling one-hour budget as percentages (call count, total time, CPU time) — throttling begins when any field hits 100\. The X-Business-Use-Case-Usage header does the same per business account and includes the most useful field in the whole system: estimated\_time\_to\_regain\_access, the number of minutes until throttling clears. When a limit is breached anyway, Meta returns documented error codes: code 4 (app-level rate limit), code 17 (user-level limit), code 32 (Pages limit), code 613 (custom rate limit), and Business Use Case codes like 80002 (Instagram) and 80006 (Messenger). A serious automation tool treats every one of these as a stop signal: pause the account, wait out the estimate, resume. Reachlee's dispatch layer does exactly this — every rate-limit error pauses the affected account for the duration Meta reports (defaulting to 5 minutes when no estimate is given).

## The undocumented soft clamp nobody writes about

Here's the part you won't find in Meta's docs or in competitor blog posts. In our experience operating connected Instagram accounts on the official API, there are throttles beyond the documented ones. Sends can begin failing with error code 2 — a generic 'service temporarily unavailable' — with no usage headers indicating a breach and no estimated\_time\_to\_regain\_access to wait out. Meta also enforces policy-level blocks that behave like rate limits: error code 368 with subcode 1404169 is a temporary block for policy violations, and it comes with no recovery header at all — retrying into it only makes things worse. On the public-comment side, subcode 1772111 flags reply activity Meta considers 'too spammy.' We can't tell you the exact thresholds that trip these, because Meta doesn't publish them — and we'd rather say that plainly than invent a number. What we can tell you is how they behave: they appear under sustained high-volume sending, they carry no recovery estimate, and the only safe response is to stop sending on that account and wait (Reachlee pauses the account for a full 24 hours on a policy block). This soft clamp is the real ceiling on Instagram DM automation — and it's precisely the one that 'unlimited DMs' marketing pretends doesn't exist.

What this means for you

## Reading the limits like an operator

01

### Pauses are a feature, not a failure

When a reputable tool stops sending for a while, it's reading Meta's usage headers and backing off before your account gets flagged. Reachlee's pre-flight gate checks token validity, the 24h window, and live rate-limit usage before every single send, and defers automatically when usage runs high. Tools that never pause aren't faster — they're just not looking.

02

### 'Unlimited DMs' from unofficial tools is a trap

Tools that automate through a logged-in session instead of the official API aren't subject to API rate limits — they're subject to Instagram's anti-bot systems instead, which respond with checkpoints, action blocks, and bans on your account. The viral 'safe sending limits' spreadsheets are folk attempts to reverse-engineer those systems. The official API's limits are stricter on paper but they come with a guarantee: stay inside them and your account isn't the one at risk.

03

### Policy limits bind long before technical ones

At 300 sends per second, the Send API could theoretically move over a million messages an hour per account. You will never get near that, because the 24-hour window and the one-reply-per-comment rule cap who you're allowed to message at all. Anyone selling you DM automation on raw throughput numbers is answering the wrong question.

04

### Design for the window, not against it

The compliant playbook: use comment triggers to earn the first DM via private reply, make that DM good enough that the user replies (opening the 24-hour window), and capture an email or lead inside the window so you can follow up on a channel you own. That's the whole game — and it's exactly what comment-to-DM funnels are for.

The bottom line

If you remember one thing: Instagram's real DM limits are mostly about permission, not volume. Meta never publishes a daily DM cap for the official API because the binding constraints are the 24-hour messaging window, the one-private-reply-per-comment rule, and formula-based call budgets enforced through response headers — plus an undocumented soft clamp that punishes sustained aggressive sending with generic errors and no recovery estimate. Any tool built on the official API lives inside all of these, whatever its pricing page says. The tools that acknowledge the limits and engineer around them (backoff, budgets, dedup) are the ones whose customers' accounts are still alive next year.

FAQ

## Instagram DM limits — FAQ

How many DMs can I send per day on Instagram?

There is no official daily number. For the official Messaging API, Meta publishes per-second and per-hour technical limits (up to 300 text sends/second per account, 750 private replies/hour) plus formula-based call budgets — but no 'X DMs per day' cap, because policy rules (the 24-hour window, one reply per comment) constrain who you can message long before throughput does. The daily figures you see online — '50 DMs a day for new accounts,' '200 per hour' — are community guesses about manual sending and unofficial bots, not documented API limits. As of August 2026, no such number appears anywhere in Meta's developer documentation.

What is the Instagram 24-hour rule?

Per Meta's Instagram Messaging documentation: 'Your app has 24 hours to respond to any message sent from an Instagram user to your app user.' In practice, a business can send free-form DMs to someone only within 24 hours of that person's last message to the business. Each new user message, story reply, story reaction, or story mention resets the clock. Outside the window, only the HUMAN\_AGENT tag is permitted — it extends the window to 7 days, requires Meta App Review approval, and is meant for human support escalation, not automated marketing. Promotional messages outside the window without a tag are prohibited.

Can automation DM someone who never messaged me?

No. Meta's docs are explicit that conversations only begin when an Instagram user messages the business first — through a DM, a story reply, a story mention, or by commenting on a post the business private-replies to. The official API physically cannot cold-DM a stranger, and no compliant tool will offer it. The one earned exception is the private reply: if someone comments on your post or reel, you may send them exactly one DM in response, within 7 days. That's the compliant version of outreach — the user acts first, every time.

What happens if a tool exceeds Instagram's limits?

First, throttling: Meta's response headers report usage, and once a budget hits 100% the API starts returning rate-limit errors (codes 4, 17, 32, 613, or Business Use Case codes like 80002) along with an estimated\_time\_to\_regain\_access value in minutes. A well-built tool pauses and waits it out. Push harder and you escalate to policy-level blocks — such as error 368 with subcode 1404169 — which arrive with no recovery estimate at all. Sustained violations risk Meta flagging the app itself, and, for unofficial tools, action blocks or bans on the user's Instagram account. This is why serious tools ship circuit breakers.

Is there a limit on comment auto-replies (comment-to-DM)?

Yes, three of them, all from Meta's documentation. One: exactly one private reply per comment, ever — you cannot DM the same comment twice. Two: the reply must be sent within 7 days of the comment being created (for posts and reels; live comments only during the broadcast). Three: 750 private replies per hour per Instagram professional account. Reachlee enforces an internal ceiling of 600 per hour under Meta's 750 to keep headroom for bursts, and records every replied comment durably so a comment can never be replied to twice, even across restarts.

Is the '200 DMs per hour' limit real?

Not for the official API. The '200 per hour' figure (and its cousins: 50/day for new accounts, 100/day warm-up schedules) comes from communities reverse-engineering Instagram's anti-spam heuristics for manual sending and session-based bots. Those heuristics are real but unpublished, account-specific, and change without notice — which is why the numbers vary between every article that repeats them. The official Messaging API has a completely different limit system: documented per-second and per-hour caps, formula-based budgets, and usage headers. As of August 2026, '200 DMs per hour' appears nowhere in Meta's developer docs.

Does a story reply or story reaction open the messaging window?

Yes. Meta's messaging documentation lists the user actions that begin a conversation with a business: sending a DM, replying to the business's story, reacting to a story, and mentioning the business in a story. Each of these opens (or resets) the 24-hour window during which the business can send free-form messages. What does not open the window: the user merely commenting on a post (that only earns a single private reply), or tapping a web link. This distinction is why story-reply automations can hold a real back-and-forth conversation while comment automations get one shot.

Do Instagram's API limits reset at a specific time?

No fixed reset hour. Meta's Business Use Case limits use rolling windows — the Instagram platform budget is computed over a rolling 24 hours (4,800 calls × impressions), and the per-app platform tier over a rolling hour (200 calls × daily active users). When you're throttled, the X-Business-Use-Case-Usage response header includes estimated\_time\_to\_regain\_access, stated in minutes — that's Meta telling you exactly when you can resume, and it's the value compliant tools sleep on. Because windows roll continuously, spreading activity out recovers budget gradually rather than all at once at midnight.

Keep exploring

## Sources — Meta's own documentation

[Graph API rate limiting (Meta)The rate-limit formulas, per-endpoint caps, usage headers, and error codes cited on this page.](https://developers.facebook.com/docs/graph-api/overview/rate-limiting)[Instagram Messaging API (Meta)The 24-hour window, conversation-entry points, message tags, and content rules.](https://developers.facebook.com/docs/messenger-platform/instagram)[Instagram Platform webhooks (Meta)How message and comment events reach automation tools in the first place.](https://developers.facebook.com/docs/instagram-platform/webhooks)[Meta permissions referenceThe scopes an app must be approved for before it can message anyone.](https://developers.facebook.com/docs/permissions)

Pricing

## Automation that respects the limits

Reachlee runs on the official Meta API with rate-limit backoff, per-account send budgets, and one-reply-per-comment enforcement built in — so your account stays safe while the automation runs. Pro is $9/mo flat with unlimited DMs and contacts. Start free with 1,000 DMs a month.

[Start free ](/app/)

Keep exploring

## Keep reading

[Instagram DM automation, explainedThe full guide to what automation can and can't do.](/instagram-dm-automation/)[Is DM automation allowed?Official API vs bots, and where the line actually is.](/instagram-dm-automation/is-it-allowed/)[Instagram automation rulesThe four rules that bind every tool, and what gets accounts restricted.](/guides/instagram-automation-rules/)[Comment-to-DM automationThe compliant funnel built on private replies.](/use-cases/comment-to-dm/)[Reachlee is Meta-verifiedWhat Meta's app review actually checks for.](/meta-verified/)[All guidesEvery Reachlee deep-dive in one place.](/guides/)

---
Source: https://www.reachlee.co/guides/instagram-dm-limits