cPanel disk space management: automating email cleanup with Dovecot queries

Disk exhaustion triggered by legacy email pile-ups is one of the most frequent incidents in the hosting industry. The root cause is rarely the sudden influx of new data; more often, it is the silent failure of background cleanup automation that went unnoticed for months.

In the forensic cases I've analyzed, standardized maintenance scripts are often inadvertently removed or moved during server migrations or control panel updates. This leads to exponential trash growth, unrotated logs, and specific accounts rapidly consuming the entire partition blocks. The immediate remediation path involves restoring cron-based cleanup routines and implementing proactive validation policies at the MTA level.

1) Disk space and quota diagnostics#

Before initiating any email purges, the administrator must map storage bottlenecks on the system partition.

1.1 general space verification#

To audit block consumption on the primary mount point hosting email directories under home:

df -h /home

Identify the top 10 most space-consuming email accounts in the filesystem:

du -sh /home/*/mail/ | sort -rh | head -10

To list accounts consuming more than 1GB:

du -sh /home/*/mail/ | awk '$1 ~ /G/ {print}'

1.2 Dovecot and cPanel quota verification#

To audit if logical limits are enforced correctly at the operating system and mail server levels:

1. Verify Active User Quotas:

   doveadm quota get -u [email protected]

1. Query Physical Disk Quota Limits:

   repquota -a | grep user

1. Adjust Quotas via cPanel UI or CLI:

Quotas can be redefined by domain inside WHM at WHM > Modify an Account > Quota to prevent individual users from monopolizing partition blocks.

1.3 verifying other disk consumption areas#

Do not restrict diagnostics only to Maildir paths. Check for residual orphan files and large log files on the host:

1. Audit Large Log Files in log:

   find /var/log -name "*.log" -size +100M -exec ls -lh {} \;

1. Purge Old Temp Files in tmp:

   find /tmp -type f -mtime +7 -exec rm -f {} \;

1. Locate Old Unrotated System Backups:

   find /backup -name "*.tar.gz" -mtime +30 -exec rm -f {} \;

2) Triage and verification of Dovecot and cPanel health#

To ensure mail management binaries behave as expected, verify that authentication daemons and control panel utilities are stable.

2.1 verification of Dovecot status and version#

To audit Dovecot health via SSH:

# Check daemon operational status
systemctl status dovecot

# Print installed version
doveadm --version

# Dump active configuration parameters (non-defaults)
doveconf -n | head -20

# Filter mail log for Dovecot-specific errors
tail -50 /var/log/maillog | grep -iE "error|dovecot"

2.2 verification of cPanel version and tools#

Validate the consistency of administrative backend features:

# Query active cPanel build version
cat /usr/local/cpanel/version

# Verify pending system update tasks status
/scripts/upcp --status

Usage Note: Ensure the visual interface cleanup utility is enabled at WHM > Email > Email Disk Usage in the administrator web portal.

3) Security protocol and preventive backups#

Any batch deletion script or spool purging query must be preceded by strict backup safety protocols to prevent accidental deletion of critical corporate records.

3.1 preventive email account backups#

Execute a recursive compressed physical backup of mail directories for system user accounts before applying cleanup queries:

1. Generic Backup of All Mail Spools:

   for user in $(ls /home/); do
       if [ -d "/home/$user/mail" ]; then
           tar czf /root/mail-backup-$user-$(date +%Y%m%d).tar.gz /home/$user/mail/
       fi
   done

1. Surgical doveadm Backup for Specific Account:

   doveadm backup -u [email protected] -f maildir:/root/backup/

4) Native cPanel cleanup using Dovecot queries#

The Email Disk Usage interface within cPanel supports powerful, native Dovecot search queries for extremely granular cleanup.

4.1 time-based cleanup#

savedbefore 30d

Removes all messages whose directory save timestamp is older than 30 days.

4.2 sender-based cleanup#

from "[email protected]"

Surgical filtering to purge redundant monitoring alert emails and automated cron output.

4.3 junk and trash smart filter cleanup#

Inside the Trash or Junk folders, use:

all

To purge every message in the selected target directory unconditionally, or apply conditional filters:

seen savedbefore 15d

Removes only messages that have already been marked as read (seen) and are older than 15 days, preserving fresh accidental deletions.

5) Advanced and automated cleanup#

5.1 advanced CLI via doveadm#

Mailbox cleaning operations performed via the GUI can be automated at scale via terminal command lines:

• doveadm purge: Consolidates raw filesystem block storage by physically removing deleted flags.
• doveadm expunge: Permanently purges messages matching targeted criteria:

  doveadm expunge -u [email protected] mailbox INBOX savedbefore 30d

5.2 automation via cron job#

To automate preventive purging of old messages across all cPanel server accounts in batch mode, create cleanup-emails.sh:

cat > /usr/local/bin/cleanup-emails.sh << 'EOF'
#!/bin/bash
# Find and expunge messages older than 30 days from all mailboxes in batch
doveadm -A search savedbefore 30d | while read user mailbox; do
    doveadm expunge -u "$user" mailbox "$mailbox" savedbefore 30d
done
EOF

chmod +x /usr/local/bin/cleanup-emails.sh

Schedule in root's crontab to run daily at 3:00 AM:

echo "0 3 * * * /usr/local/bin/cleanup-emails.sh" | crontab -

Verify the active task scheduler:

crontab -l

5.3 post-cleanup validation#

Following manual or cron-based purges, confirm that storage capacity has been recovered:

1. Verify Partition Disk Space Before and After:

   df -h /home

1. Review Directory Block Sizes:

   du -sh /home/*/mail/

1. Count Remaining Target Spool Messages:

   doveadm search -u [email protected] INBOX "savedbefore 30d" | wc -l

1. Audit Transaction Logs in maillog:

   tail -50 /var/log/maillog | grep -iE "error|fail"

5.4 proactive monitoring#

To alert system support before user mailboxes saturate partitions, write the check-email-disk.sh script:

cat > /usr/local/bin/check-email-disk.sh << 'EOF'
#!/bin/bash
# Count accounts with mail spools larger than 1GB
USAGE=$(du -sh /home/*/mail/ 2>/dev/null | awk '$1 ~ /G/ {count++} END {print count+0}')
THRESHOLD=5

if [ "$USAGE" -gt "$THRESHOLD" ]; then
    echo "ALERT: Detected $USAGE email accounts consuming more than 1GB on cPanel." | \
      mail -s "Email Disk Alert" [email protected]
fi
EOF

chmod +x /usr/local/bin/check-email-disk.sh

Schedule the diagnostic task to run daily at 6:00 AM:

echo "0 6 * * * /usr/local/bin/check-email-disk.sh" | crontab -

6) Governance: email retention policies#

Email spool cleaning automations must align with corporate data retention policy rules agreed upon with legal teams:

Recommended retention matrix by folder and role#

7) Operational cleanup checklist and risk matrix#

Email cleanup checklist#

• [ ] Phase 1: Initial Triage
• [ ] Audit partition free blocks on /home.
• [ ] Identify Maildirs consuming the most blocks.
• [ ] Check Dovecot status, versions, and log files.
• [ ] Validate quota consistency in cPanel limits.
• [ ] Phase 2: Safety Backup
• [ ] Create compressed backups (tar) of mail folders for critical users.
• [ ] Verify backup archive integrity.
• [ ] Phase 3: Expunge Execution
• [ ] Purge junk mail folders (savedbefore 30d).
• [ ] Purge discarded items (Trash older than 15 days).
• [ ] Exclude oversized attachment spools (larger 10M).
• [ ] Phase 4: Post-Cleanup Checks
• [ ] Verify free storage capacity increase.
• [ ] Test client send and receive actions.
• [ ] Inspect log files for errors.
• [ ] Phase 5: Automation Setup
• [ ] Schedule the cleanup-emails.sh script in cron.
• [ ] Enable the check-email-disk.sh monitoring alert.

Spool disk cleanup risk matrix#

Managing email storage in cPanel requires method. By combining structured diagnostics, isolated backups, programmatic Dovecot search queries, and clear governance, you secure email infrastructure against disk saturation outages.

See also

Infrastructure Anatomy of a phantom email: filesystem and Dovecot IMAP desynchronization

Infrastructure The ghost IP mystery: when CSF ignores whitelists, NAT, and connection state

Infrastructure The Forwarding Trap and Backscatter Loops in Exim: Avoiding SPFBL and UCEPROTECT-L3 Blocks

This post is licensed under CC BY-NC.