I am sharing an incident that may be relevant to other OVHcloud Hosted Exchange users.
I discovered that some legitimate messages were not reaching my mailbox. The sending server recorded them as delivered to OVHcloud’s mail servers, but:
-
they did not appear in the inbox or spam folder;
-
they were not available in a recoverable quarantine;
-
the sender received no rejection or delivery-failure notification;
-
the recipient received no warning.
I carried out several controlled tests using the mailbox’s primary address. OVHcloud support confirmed that Vade Secure had discarded some of the messages because they contained a URL under the rb.gy shortening domain.
According to the responses from support:
-
filtering is applied at infrastructure level;
-
customers cannot modify these rules;
-
affected messages are discarded and cannot be recovered;
-
neither the sending server nor the recipient is informed of the block;
-
there is no public documentation describing the indicators that trigger these discards;
-
detailed traces available to support are retained for only 30 days, although other logs are kept for one year.
The test messages themselves are not the main issue. The concern is that there is no way to know which previous legitimate communications may have been discarded in the same way, without either party being aware that delivery had failed. This makes it impossible to determine whether an important communication was lost or whether any resulting harm occurred.
Relationship with SMTP and RFC 5321
I am not claiming that this necessarily constitutes a formal violation of RFC 5321, because OVHcloud has not provided the exact SMTP response returned after DATA.
However, RFC 5321 states that when a server returns a positive 2yz response after receiving the message content, it assumes responsibility for delivering the message, retrying delivery, or subsequently reporting the failure. It also allows messages to be rejected for policy reasons during the SMTP transaction using responses such as 450 or 550.
The same RFC recognises that mail may sometimes be discarded without notifying the sender, particularly in cases involving hostile content. However, it describes this practice as extremely dangerous and recommends restricting it to situations where there is very high confidence that the message is seriously fraudulent or inappropriate.
In this case, the sending server recorded successful delivery, while OVHcloud later confirmed that the message had been discarded because it contained a specific URL. At the very least, this raises concerns about transparency, auditability and confidence in email reception.
I am sharing this experience so that other customers are aware of this behaviour and can assess the associated risk. Given the inability to detect or recover discarded messages, and the lack of user control, I intend to evaluate alternative European email-hosting providers after more than 10 years as an OVHcloud customer.
Reference
RFC 5321 — Simple Mail Transfer Protocol, particularly sections 4.2.5, 4.3.2, 6.1 and 6.2:
