diff --git a/src/api/server_server.rs b/src/api/server_server.rs
index 398aff76..ecf2f571 100644
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
@@ -327,40 +327,55 @@ pub(crate) async fn send_transaction_message_route(
 
 				for (room_id, room_updates) in receipt.receipts {
 					for (user_id, user_updates) in room_updates.read {
-						if let Some((event_id, _)) = user_updates
-							.event_ids
-							.iter()
-							.filter_map(|id| {
+						if services()
+							.rooms
+							.event_handler
+							.acl_check(user_id.server_name(), &room_id)
+							.is_err()
+						{
+							debug_warn!(%user_id, %room_id, "received read receipt EDU from ACL'd user's server");
+							continue;
+						}
+
+						if services().rooms.state_cache.is_joined(&user_id, &room_id)? {
+							if let Some((event_id, _)) = user_updates
+								.event_ids
+								.iter()
+								.filter_map(|id| {
+									services()
+										.rooms
+										.timeline
+										.get_pdu_count(id)
+										.ok()
+										.flatten()
+										.map(|r| (id, r))
+								})
+								.max_by_key(|(_, count)| *count)
+							{
+								let mut user_receipts = BTreeMap::new();
+								user_receipts.insert(user_id.clone(), user_updates.data);
+
+								let mut receipts = BTreeMap::new();
+								receipts.insert(ReceiptType::Read, user_receipts);
+
+								let mut receipt_content = BTreeMap::new();
+								receipt_content.insert(event_id.to_owned(), receipts);
+
+								let event = ReceiptEvent {
+									content: ReceiptEventContent(receipt_content),
+									room_id: room_id.clone(),
+								};
 								services()
 									.rooms
-									.timeline
-									.get_pdu_count(id)
-									.ok()
-									.flatten()
-									.map(|r| (id, r))
-							})
-							.max_by_key(|(_, count)| *count)
-						{
-							let mut user_receipts = BTreeMap::new();
-							user_receipts.insert(user_id.clone(), user_updates.data);
-
-							let mut receipts = BTreeMap::new();
-							receipts.insert(ReceiptType::Read, user_receipts);
-
-							let mut receipt_content = BTreeMap::new();
-							receipt_content.insert(event_id.to_owned(), receipts);
-
-							let event = ReceiptEvent {
-								content: ReceiptEventContent(receipt_content),
-								room_id: room_id.clone(),
-							};
-							services()
-								.rooms
-								.read_receipt
-								.readreceipt_update(&user_id, &room_id, event)?;
+									.read_receipt
+									.readreceipt_update(&user_id, &room_id, event)?;
+							} else {
+								// TODO fetch missing events
+								debug_error!("No known event ids in read receipt: {:?}", user_updates);
+							}
 						} else {
-							// TODO fetch missing events
-							debug_error!("No known event ids in read receipt: {:?}", user_updates);
+							debug_warn!(%user_id, %room_id, "received read receipt EDU for user not in room");
+							continue;
 						}
 					}
 				}