Dovecot: is there a way to delete specific email from ALL mailboxes of one domain?

I want to be able to delete specific email message from all mailboxes of one domain, does Dovecot has this type of functionality OR are there any known good solution for this? It's Maildir format and the domain is represented as /var/vmail/domain.tld/.

The problem

many disposable, one-shot bulk emails, often with multi-megabyte attachments.

What have I tried

I have looked to doveadm Batch, Altmove, Expunge commands, none of which seems to do the (exactly this type of) job?

What I'd like to avoid if possible

The last resort: grep recursively by either Message-ID header or ESMTP id part of one of the multiple Received headers.

EDIT: Thanks for comments and answer so far, by reading them I realize that I failed to make a point: it is not a SPAM issue - those bulk emails are perfectly legitimate but after a while completely unnecessary and since they weigh multi MBs the storage problem needs to be prevented.

Solution 1:

Doveadm can move or expunge mails, offering pretty much all the filters needed for this task.

First, try your filters using a readonly command, such as fetch, so you do not move or delete more mail than intended:

doveadm -u [email protected] fetch 'hdr.from hdr.subject' FROM spammer.example HEADER message-id '[email protected]'

The syntax for the search is documented in man doveadm-search-query, but the precise query is still up to you - what is a good selection for you?

Note that deleting purely by message-id lead to unpleasant side-effects in the form of lost mail, as spammers and/or software bugs occasionally recycle meanto-to-be-unique ids.

When selecting copies or variants of essentially the same mail, you probably want to use some combination of date, relaying server and header value. If you only care about size, selecting by age and size should do the trick.

How to limit your command to a single domain?

If your mail account names look like [email protected], give doveadm a wildcard:

doveadm -u *@example.org move spamfolder FROM spammer.example HEADER unique value

If your mail account names are less predictably names, supply a fixed list:

psql -c 'COPY (SELECT mailname FROM users WHERE ..) TO stdout (format csv);' > userlist_example.org
doveadm -F userlist_example.org move spamfolder FROM spammer.example HEADER unique value