Zimbra massive message delete across all mailboxes

delete-messages.sh

#!/bin/bash

# This script cycle throug all email users and try to find an email with a particular subject and erase it
# Author: [email protected] circa 2024

# usage
if [ -z "$1" ]; then
	echo "Goal: search for an emails with a subject and erase them"
	echo "usage: Delete-mails <subject_simple_pattern> [option]"
	echo "Option is:"
	echo "   -t: Test, just show the subject [default if empty]"
	echo "   -s: Mark it as SPAM"
	echo "   -d: Delete"
	exit 0
fi

#
counter=0

function eraseit () { 
	# inputs
	# - Address
	# - Subject pattern
	# - test [don't erase]

	echo "Searching for Subject pattern: '${2}' on mailbox: ${1}"
	list=$(zmmailbox -z -m "${1}" s -l 999 -t message "subject: ${2}" | awk '$1 ~ /^[0-9]/ {print $2}')

	for msg in $(echo $list) ; do
		# test /default
		if [ "$3" == "" -o "$3" == "-t" ] ; then
			echo "  - Found $(zmmailbox -z -m "${1}" gm ${msg} | grep "Subject:" | head -n1)"
			counter=$((counter + 1))
			continue
		fi

		# mark as SPAM
		if [ "$3" == "-s" ] ; then
			echo "  - Marking msg ${msg} as SPAM / moved to Junk"
			zmmailbox -z -m "${1}" markMessageRead ${msg} 1
			zmmailbox -z -m "${1}" markMessageSpam ${msg} 1 /Junk
			counter=$((counter + 1))
			continue
		fi

		# delete it
		if [ "$3" == "-d" ] ; then
			echo "  - Removing ${msg} [$(zmmailbox -z -m "${1}" gm ${msg} | grep "Subject:" | head -n1)]"
			zmmailbox -z -m ${1} deleteMessage ${msg}
			counter=$((counter + 1))
		fi
	done
}

# cycle over all users
for user in `zmprov -l gaa`
do
	# reindex and sync the mailbox
	#zmprov rim "${user}" start > /dev/null

	# eraseit
	eraseit "${user}" "${1}" "${2}"
done

# how many messages found
echo "Found $counter messages"

# fin
echo "Done!"

Updates on this day, to show only the first Subject line, Spammers are just piggybacking on email threads and you get a bunch of lines of subjects of actual email conversations [but not relevant to you]

Added a counter at the end for you to know how many messages are found/erased/moved to spam. etc.

Update, if your subject search is too generic you can use other parts of the headers to search

For example, I have a phshing email that states "Contract Agreement" but the search pattern is to wide to erase at a glance, searching with -t confirm that.

But the email came from an email [email protected], you can use this search term to narrow it down:

"Contract Agreement, from: [email protected]" and it will parse the first string related to the subject, then se second part will match the from.

Spoiler: it works on any header or part, you can add more filters like:

• from:
• message-id:
• date:
• sender:

Any header of the email source can be filtered