diff --git a/apps/base/mail/rspamd-deployment.yaml b/apps/base/mail/rspamd-deployment.yaml
index 2764651..ee3b9ba 100644
--- a/apps/base/mail/rspamd-deployment.yaml
+++ b/apps/base/mail/rspamd-deployment.yaml
@@ -101,12 +101,19 @@ spec:
           configMap:
             name: rspamd-sa-rules
         - name: dkim
-          secret:
-            secretName: dkim-unkin-net
+          projected:
             defaultMode: 0440
-            items:
-              - key: private_key
-                path: unkin.net.mail.key
+            sources:
+              - secret:
+                  name: dkim-unkin-net
+                  items:
+                    - key: private_key
+                      path: unkin.net.mail.key
+              - secret:
+                  name: dkim-main-unkin-net
+                  items:
+                    - key: private_key
+                      path: main.unkin.net.mail.key
         - name: data
           emptyDir: {}
 ---
diff --git a/apps/base/mail/rspamd-vault.yaml b/apps/base/mail/rspamd-vault.yaml
index 6a07a11..7096600 100644
--- a/apps/base/mail/rspamd-vault.yaml
+++ b/apps/base/mail/rspamd-vault.yaml
@@ -60,6 +60,24 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
+# DKIM private key for main.unkin.net, selector `mail` (field `private_key`).
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: dkim-main-unkin-net
+  namespace: mail
+spec:
+  destination:
+    create: true
+    name: dkim-main-unkin-net
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/mail/default/dkim-main-unkin-net
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
 # Controller (web UI) password; config reads the `rspamadm pw` hash (field `password_hash`).
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
diff --git a/apps/base/mail/rspamd/dkim_signing.conf b/apps/base/mail/rspamd/dkim_signing.conf
index fce2716..1f1440f 100644
--- a/apps/base/mail/rspamd/dkim_signing.conf
+++ b/apps/base/mail/rspamd/dkim_signing.conf
@@ -2,6 +2,7 @@ sign_authenticated = false;
 sign_local = true;
 sign_inbound = false;
 use_domain = "header";
+use_esld = false;
 allow_hdrfrom_mismatch = false;
 selector = "mail";
 path = "/etc/rspamd/dkim/$domain.$selector.key";
diff --git a/apps/base/mail/smarthost/relay_domains b/apps/base/mail/smarthost/relay_domains
index 59818b2..856ab55 100644
--- a/apps/base/mail/smarthost/relay_domains
+++ b/apps/base/mail/smarthost/relay_domains
@@ -1 +1,2 @@
 unkin.net OK
+main.unkin.net OK
diff --git a/apps/base/mail/smarthost/transport b/apps/base/mail/smarthost/transport
index 828306f..73a02db 100644
--- a/apps/base/mail/smarthost/transport
+++ b/apps/base/mail/smarthost/transport
@@ -1 +1,2 @@
 unkin.net lmtp:[stalwart.mail.svc.cluster.local]:24
+main.unkin.net lmtp:[stalwart.mail.svc.cluster.local]:24
diff --git a/apps/base/mail/stalwart-configmap.yaml b/apps/base/mail/stalwart-configmap.yaml
index cf485e4..3ea6350 100644
--- a/apps/base/mail/stalwart-configmap.yaml
+++ b/apps/base/mail/stalwart-configmap.yaml
@@ -12,7 +12,7 @@ data:
   config.json: |
     {"@type":"PostgreSql","host":"stalwart-db-rw.mail.svc","port":5432,"database":"stalwart","authUsername":"stalwart","authSecret":{"@type":"EnvironmentVariable","variableName":"DB_PASSWORD"},"useTls":true}
   plan.ndjson: |
-    {"@type":"upsert","object":"Domain","matchOn":["name"],"value":{"unkin":{"name":"unkin.net","certificateManagement":{"@type":"Manual"},"dkimManagement":{"@type":"Manual"},"dnsManagement":{"@type":"Manual"},"subAddressing":{"@type":"Enabled"}}}}
+    {"@type":"upsert","object":"Domain","matchOn":["name"],"value":{"unkin":{"name":"unkin.net","aliases":{"main.unkin.net":true},"certificateManagement":{"@type":"Manual"},"dkimManagement":{"@type":"Manual"},"dnsManagement":{"@type":"Manual"},"subAddressing":{"@type":"Enabled"}}}}
     {"@type":"upsert","object":"Certificate","matchOn":["certificate"],"value":{"cert":{"certificate":{"@type":"File","filePath":"/etc/stalwart/tls/tls.crt"},"privateKey":{"@type":"File","filePath":"/etc/stalwart/tls/tls.key"}}}}
     {"@type":"upsert","object":"Directory","matchOn":["description"],"value":{"authentik":{"@type":"Oidc","description":"Authentik","issuerUrl":"https://identity.unkin.net/application/o/stalwart/","requireAudience":"stalwart","requireScopes":{},"claimUsername":"preferred_username","usernameDomain":"unkin.net","claimName":"name"}}}
     {"@type":"upsert","object":"Application","matchOn":["description"],"value":{"webui":{"description":"Stalwart Web Interface","resourceUrl":"https://github.com/stalwartlabs/webui/releases/download/v1.0.11/webui.zip","urlPrefix":{"/admin":true,"/account":true},"unpackDirectory":"/var/lib/stalwart/webui","oauthClientId":"stalwart"}}}