diff --git a/apps/base/mail/smarthost/main.cf b/apps/base/mail/smarthost/main.cf
index 865db83..7c4ca46 100644
--- a/apps/base/mail/smarthost/main.cf
+++ b/apps/base/mail/smarthost/main.cf
@@ -9,7 +9,7 @@ inet_protocols = ipv4
 maillog_file = /dev/stdout
 message_size_limit = 52428800
 
-# Relay-anywhere clients, all routed through rspamd for DKIM signing; gateways must stay out.
+# Relay-anywhere clients; gateways must stay out.
 mynetworks = cidr:/etc/postfix/mynetworks.cidr
 
 relay_domains = texthash:/etc/postfix/relay_domains
@@ -31,8 +31,8 @@ address_verify_positive_refresh_time = 1h
 address_verify_positive_expire_time = 1d
 
 milter_default_action = tempfail
-smtpd_milters =
-smtpd_milter_maps = cidr:/etc/postfix/mynetworks.cidr
+smtpd_milters = inet:rspamd.mail.svc:11332
+smtpd_authorized_xforward_hosts = cidr:/etc/postfix/gateways.cidr
 
 smtpd_tls_security_level = may
 smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
diff --git a/apps/base/mail/smarthost/master.cf b/apps/base/mail/smarthost/master.cf
index 2f3bf5f..94ed1f7 100644
--- a/apps/base/mail/smarthost/master.cf
+++ b/apps/base/mail/smarthost/master.cf
@@ -1,4 +1,4 @@
-# Gateways (inbound to relay_domains, no milter) and mynetworks (relay anywhere via rspamd).
+# Gateways (inbound to relay_domains) and mynetworks (relay anywhere); all via the rspamd milter.
 25        inet  n       -       n       -       -       smtpd
 pickup    unix  n       -       n       60      1       pickup
 cleanup   unix  n       -       n       -       0       cleanup
diff --git a/apps/base/mail/smarthost/mynetworks.cidr b/apps/base/mail/smarthost/mynetworks.cidr
index 32779ce..c9f5e9d 100644
--- a/apps/base/mail/smarthost/mynetworks.cidr
+++ b/apps/base/mail/smarthost/mynetworks.cidr
@@ -1,31 +1,31 @@
 # Pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
-# Doubles as mynetworks and the milter map; keep in sync with the NetworkPolicy.
-10.42.0.0/16 inet:rspamd.mail.svc:11332
-10.10.12.200/32 inet:rspamd.mail.svc:11332
-198.18.1.10/32 inet:rspamd.mail.svc:11332
-198.18.2.160/27 inet:rspamd.mail.svc:11332
-198.18.2.192/27 inet:rspamd.mail.svc:11332
-198.18.21.160/27 inet:rspamd.mail.svc:11332
-198.18.21.192/27 inet:rspamd.mail.svc:11332
-198.18.13.0/24 inet:rspamd.mail.svc:11332
-198.18.14.0/24 inet:rspamd.mail.svc:11332
-198.18.15.0/24 inet:rspamd.mail.svc:11332
-198.18.16.0/24 inet:rspamd.mail.svc:11332
-198.18.17.0/24 inet:rspamd.mail.svc:11332
-198.18.18.0/24 inet:rspamd.mail.svc:11332
-198.18.19.0/24 inet:rspamd.mail.svc:11332
-198.18.20.0/24 inet:rspamd.mail.svc:11332
-198.18.21.0/24 inet:rspamd.mail.svc:11332
-198.18.22.0/24 inet:rspamd.mail.svc:11332
-198.18.23.0/24 inet:rspamd.mail.svc:11332
-198.18.25.0/24 inet:rspamd.mail.svc:11332
-198.18.26.0/24 inet:rspamd.mail.svc:11332
-198.18.27.0/24 inet:rspamd.mail.svc:11332
-198.18.28.0/24 inet:rspamd.mail.svc:11332
-198.18.29.0/24 inet:rspamd.mail.svc:11332
-198.18.64.0/24 inet:rspamd.mail.svc:11332
-198.18.65.0/24 inet:rspamd.mail.svc:11332
-198.18.66.0/24 inet:rspamd.mail.svc:11332
-198.18.67.0/24 inet:rspamd.mail.svc:11332
-198.18.68.0/24 inet:rspamd.mail.svc:11332
-198.18.69.0/24 inet:rspamd.mail.svc:11332
+# Keep in sync with the NetworkPolicy.
+10.42.0.0/16 OK
+10.10.12.200/32 OK
+198.18.1.10/32 OK
+198.18.2.160/27 OK
+198.18.2.192/27 OK
+198.18.21.160/27 OK
+198.18.21.192/27 OK
+198.18.13.0/24 OK
+198.18.14.0/24 OK
+198.18.15.0/24 OK
+198.18.16.0/24 OK
+198.18.17.0/24 OK
+198.18.18.0/24 OK
+198.18.19.0/24 OK
+198.18.20.0/24 OK
+198.18.21.0/24 OK
+198.18.22.0/24 OK
+198.18.23.0/24 OK
+198.18.25.0/24 OK
+198.18.26.0/24 OK
+198.18.27.0/24 OK
+198.18.28.0/24 OK
+198.18.29.0/24 OK
+198.18.64.0/24 OK
+198.18.65.0/24 OK
+198.18.66.0/24 OK
+198.18.67.0/24 OK
+198.18.68.0/24 OK
+198.18.69.0/24 OK