diff --git a/ChangeLog.txt b/ChangeLog.txt
index 1a802369..4f6af3af 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -19,6 +19,10 @@ Broker:
 - Add `--tls-keylog` option which can be used to generate a file that can be
   used by wireshark to decrypt TLS traffic for debugging purposes. Closes #1818.
 - Add support for delayed basic authentication in plugins.
+- Plugins using the MOSQ_EVT_MESSAGE callback can now return
+  MOSQ_ERR_QUOTA_EXCEEDED to have the message be rejected. MQTT v5 clients
+  using QoS 1 or 2 will receive the quota-exceeded reason code in the
+  corresponding PUBACK/PUBREC.
 
 Client library:
 - Add MOSQ_OPT_DISABLE_SOCKETPAIR to allow the disabling of the socketpair
diff --git a/include/mosquitto.h b/include/mosquitto.h
index 15632d7f..64b681d9 100644
--- a/include/mosquitto.h
+++ b/include/mosquitto.h
@@ -85,6 +85,7 @@ extern "C" {
 
 /* Error values */
 enum mosq_err_t {
+	MOSQ_ERR_QUOTA_EXCEEDED = -6,
 	MOSQ_ERR_AUTH_DELAYED = -5,
 	MOSQ_ERR_AUTH_CONTINUE = -4,
 	MOSQ_ERR_NO_SUBSCRIBERS = -3,
diff --git a/src/handle_publish.c b/src/handle_publish.c
index c41aac6a..657d6940 100644
--- a/src/handle_publish.c
+++ b/src/handle_publish.c
@@ -278,6 +278,12 @@ int handle__publish(struct mosquitto *context)
 
 			reason_code = MQTT_RC_NOT_AUTHORIZED;
 			goto process_bad_message;
+		}else if(rc == MOSQ_ERR_QUOTA_EXCEEDED){
+			log__printf(NULL, MOSQ_LOG_DEBUG,
+					"Rejected PUBLISH from %s, quota exceeded.", context->id);
+
+			reason_code = MQTT_RC_QUOTA_EXCEEDED;
+			goto process_bad_message;
 		}else if(rc != MOSQ_ERR_SUCCESS){
 			db__msg_store_free(msg);
 			return rc;