Emails Disappearing From Inbox

[Osama Tariq]

Email goes to junk and disappeared from inbox after sometime, it's happened only from one email id. Lets suppose [email protected] send email to [email protected] and it goes to junk both are from same domain and same server.
We have fixed the permissions of inbox, disabled RBLs, disabled all domain and user filters and even we have migrated account to another server but still getting same issue. Below are the logs:

2016-05-06 07:56:46 1ayYko-000a54-7r <= [email protected] H=([ServerIP]) [::1]:47897 P=esmtpa A=dovecot_login:[email protected] S=822 [email protected] T="testing email" for [email protected]
2016-05-06 07:56:46 1ayYko-000a54-7r => xyz <[email protected]> R=virtual_user T=virtual_userdelivery

 

[Osama Tariq]

More logs:

2016-05-06 17:29:45 [684078] 1ayet7-002rxW-MT <= [email protected] H=([ServerIP]) [::1]:38493 I=[::1]:25 P=esmtpa A=dovecot_login:[email protected] S=824 M8S=0 [email protected] IP T="testing email 3" from <[email protected]> for [email protected]
2016-05-06 17:29:46 [684082] 1ayet7-002rxW-MT => xyz <[email protected]> F=<[email protected]> P=<[email protected]> R=virtual_user T=virtual_userdelivery S=954 QT=1s DT=1s

 

[LostNerd]

Junk folders may be purged periodically.

 

[Osama Tariq]

Sorry i didn't get your point, please elaborate more.

 

[webhostuk]

you need to check : "WHM Home » Service Configuration » Mailserver Configuration" have you sent trash , junk folder to empty after some particular time, this feature allows to auto delete thrash email as per your requirement.

 

[Osama Tariq]

Emails moved in junk after sometime, but not removed. There's no issue with that option you have mentioned.

 

[gryzli]

Are you sure this is not done by the mail client (or client software - usually antivirus programs) which runs on the computer, checking the mailbox in question ? I have seen such issues in real , caused by antivirus software.

 

[Osama Tariq]

Yes i'm pretty sure, because i have changed email password from cpanel but not updated new password in email client but still email goes to junk after sometime, even we have deleted both account and recreate from cpanel issue still persist.

 

[gryzli]

Is SpamAssassin stopped for this account ?
How long it takes before the email is being moved ?

 

[Osama Tariq]

Spamassassin is stopped but still having issue.
After 15-20 seconds it goes to junk.

 

[gryzli]

Have you tried searching in /var/log/exim_rejectlog for the problematic message ?

 

[Osama Tariq]

There's nothing in reject logs regarding these email addresses.

 

[gryzli]

I'm out of ideas. Maybe there is some background running process ( or cron ) which does that.

You could try monitoring all processes on the server while sending the bad email. That could be a hard job, but there is a chance to see which process is spawned.
Most of the time cpanel is trying to run such processes with the user they are related to, so there is a big chance to see it with:
top -u username
where username is the uset howding the domain / email adress.

 

[Osama Tariq]

#top -u username //below output during sending/receiving email.

  28425 username  20   0 32160 2852 2192 S  0.0  0.0   0:00.00 imap                                                                               
  43871 username  20   0 32260 3172 2448 S  0.0  0.0   0:00.01 imap                                                                               
  44096 username  20   0 31912 2288 1880 S  0.0  0.0   0:00.00 imap                                                                               
  44417 username  20   0 19256 2612 2040 S  0.0  0.0   0:00.04 pop3                                                                               
  47061 username  20   0 32244 3092 2396 S  0.0  0.0   0:00.00 imap                                                                               
  55939 username  20   0 19392 2720 1956 S  0.0  0.0   0:00.00 pop3                                                                               
  56637 username  20   0 32124 2712 2228 S  0.0  0.0   0:00.00 imap                                                                               
  56857 username  20   0  104m  24m 2300 S  0.0  0.0   0:00.02 webmaild - serv                                                                   
  56868 username  20   0  247m  10m 4356 S  0.0  0.0   0:00.58 cpanel_php_fpm                                                                     
  60038 username  20   0 19512 2716 1940 S  0.0  0.0   0:00.00 pop3                                                                               
134210 username  20   0 35328 5000 2412 S  0.0  0.0   0:01.45 imap                                                                               
245561 username  20   0 32372 3252 2260 S  0.0  0.0   0:00.37 imap                                                                               
815579 username  20   0 32600 3468 2384 S  0.0  0.0   0:00.31 imap

 

[cPanelMichael]

it's happened only from one email id

Hello,

This suggests an isolated issue with this email account, likely related to a custom filter rule that's moving the message. Could you send a test message to this email account, and search the message in /var/log/exim_mainlog after you have confirmed it's automatically moved to the .Junk mail folder? EX:

exigrep [email protected] /var/log/exim_mainlog

Thank you.

 

[pacificnet.lk]

Hi All

I know this is a old thread. I got the same issue with one of my clients mail box. I manage to resolve by going to "SquirrelMail" and in
"Folders --> Unsubscribe Junk folder"
Do not know what it make it happen but fix my problem. I hope this will help anyone looking for a solution for this problem.

Thanks

 

[ar.ripon]

Same issue occur on my cPanel and trying to resolve the issue. But still do not found any solution.Any idea??

 

[cPanelMichael]

Same issue occur on my cPanel and trying to resolve the issue. But still do not found any solution.Any idea??

Could you provide some more information about what's happening and the log entry of an affected message from /var/log/exim_mainlog?

Thank you.