cPanel Custom Query Delete

Have you ever experienced flooding spam mail from internal to external? The email account in your cPanel broadcasts to unknown email address destination. The number of email queues can be tens or even hundreds of thousands. How to remove “undelivered” Backscatter mail, due to bounced email effects that enter the webmail mailbox? This simple article will explain how to easily delete custom query in cPanel.

Case: cPanel Mail Flooding from Internal to External address

cPanel WHM server flooding occured mostly because weak password. We can check mail queue with easy command exim.

exim -bpc

exim -bp

From the results of the above command, we can analyze which account source the flooding occurred.

Exim Delete Mail Queue via Command Line

Easy method exim delete mail queue via command line.

exiqgrep -i -f '[email protected]' | xargs exim -Mrm

Or if we meet mail frozen, can execute this command.

exim -bp|grep '<>' |awk {'print $3'}|xargs exim -Mrm

cPanel Roundcube Delete Mail Undelivered.

After we successfully find and determine the source of the spam email, then open the webmail user.

In picture 1 above, showing us that webmail inbox full receive mail undelivered. We can delete it by selecting all on 1 full page.

But what if there are 1000s of pages? Of course this method is not effective.

Why Need Delete Email with Custom Query in Webmail

Remember, if we have thousands or even tens of thousands of inbox in webmail and happened a backscatter mail undelivered, we will have a headache choosing to delete one by one. Because it is mixed between legitimate email and backscatter email.
Need a custom query so that only matching query strings will be deleted.
Not all emails in webmail are deleted.

How to Custom Query Delete in cPanel

Open webmail, and than navigate to “Manage Disk Usage”

Click “manage”, and select custom query.

We only want to delete emails that have the subject “Mail delivery deferred”.

Type subject "Mail delivery deferred" in custom query box. And delete permanently.

For full documentation, please read Dovecot’s Search Query Format. May be it’s helpful, please feel free to leave a comment if you have any questions and I’ll appreciate it.