$msg->header->{from} or $msg->header->{to} is no use for the job because they both show the server where the newsletter was sent from. The body has to be parsed for unknown users or hosts. The print statements prints out the wrong email adress preceded with the corresponding message: user unknown or host unknown.

My use was slightly different, as i connected to the database for the unknown users in order to flag their emails as unsubscribed and left the unknown hosts for handcraft as shown here.

So here is the code :)

#!/usr/bin/perl -w
use strict;
use Mail::MboxParser;
my $mbox = '/var/spool/mail/www37';
my $mb = Mail::MboxParser->new($mbox, decode => 'ALL');
print "Total messages: ", $mb->nmsgs, "\n";

# iterating through the mailbox
while (my $msg = $mb->next_message) {
        my $body = $msg->body($msg->find_body);
        foreach my $line (split /\n/, $body) {
                my (undef, undef, $a) = split / /, $line if $line =~ /
+Host unknown/i && $line=~/^550/;
                if ( defined $a ) {
                        $a =~ s/^<(.+)>\.\.\.$/$1/;
                        print "Host unknown: ", $a, "\n";
                        #  ...
                }

                my $b = $line if $line =~ /User unknown/i && $line =~/
+^550/;
                if ( defined $b )  {
                        $b =~ s/550 5.1.1 (.+) \(.+/$1/;
                        $b =~ s/550 5.1.1 <(.+)>.+/$1/;
                        $b =~ s/550 <(.+)>.+/$1/;
                        print "User unknown 550: ", $b, "\n";
                        # ...
                }

                my  $c = $line if $line =~ /^<<< 554/;
                if (defined $c) {
                        $c =~ s/.+to (.+) cannot.+/$1/;
                        $c =~ s/.+account \((.+)\) .+/$1/;
                        print "User unknown 554: ", $c, "\n";
                        #..
                }       
       }
}
[download]