Symptoms
When logging into my email, I noticed some messages are no longer present. Where did they go?
Description
When an Email goes missing, this is often from a user accessing this with a mail client, and that mail client downloads and removes or deletes the mail from the server. To recover your Email, you will need to restore your account.
Workaround
First, we want to perform a grep for the date range and domain. Replace the month with the three-letter abbreviation and your days. In this case, this represents Jul 25-29th.
grep -cP 'Jul 2[5-9].+pop.+test.tld' /var/log/maillog
If no results are found, this would indicate it was done over an IMAP connection. By default, dovecot does not log this information and requires additional configurations to be added. To enable more verbose logging to check this in case it happens again, you can modify the Dovecot configuration and add the following for additional IMAP logging. To enable this plugin, please review the following article: How to enable the Dovecot mail-log plugin
Please also refer to the dovecot logging documentation if you need to make further modifications.
Be sure to disable the mail-log plugin when completed. How to disable the Dovecot mail-log plugin