Count cPanel default emails

Recently a customer had an issue on their cPanel server whereby their MX records were overwritten and mail was sent to the ‘default’ email address instead of to their Office365 addresses.

To better understand what mail had been missed I used the following expression (domain removed for retain their privacy):

grep -ir "***" /home/***/mail/cur/ \
grep -i "envelope-to" | \
grep -i -o '[A-Z0-9._%+-]\[email protected][A-Z0-9.-]\+\.[A-Z]\{2,4\}' | \
sort | uniq -c | sort -nr

This will return a sorted count of emails and their intended recipients, such as the following:

25 [email protected]
10 [email protected]
9 [email protected]
9 [email protected]
8 [email protected]
7 [email protected]
7 [email protected]
4 [email protected]
3 [email protected]
1 [email protected]
1 [email protected]
1 [email protected].COM.AU

Syncing this email on with IMAP sync is a simple affair, but now we know where the best place to send the mail to to minimise any additional work in sorting.