diff --git a/apps/base/bind-internal/resolvers/acls.yaml b/apps/base/bind-internal/resolvers/acls.yaml
index 05a7f4f..f3f935f 100644
--- a/apps/base/bind-internal/resolvers/acls.yaml
+++ b/apps/base/bind-internal/resolvers/acls.yaml
@@ -38,6 +38,8 @@ spec:
   clusterRef: bind-resolvers
   entries:
     - 198.18.24.0/24
+    - 198.18.30.0/24  # BinaryLane DMZ VPC syd (mail edge, via VPN)
+    - 198.18.31.0/24  # BinaryLane DMZ VPC mel (mail edge, via VPN)
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindACL
diff --git a/apps/base/mail/smarthost/relay_domains b/apps/base/mail/smarthost/relay_domains
index 59818b2..856ab55 100644
--- a/apps/base/mail/smarthost/relay_domains
+++ b/apps/base/mail/smarthost/relay_domains
@@ -1 +1,2 @@
 unkin.net OK
+main.unkin.net OK
diff --git a/apps/base/mail/smarthost/transport b/apps/base/mail/smarthost/transport
index 828306f..73a02db 100644
--- a/apps/base/mail/smarthost/transport
+++ b/apps/base/mail/smarthost/transport
@@ -1 +1,2 @@
 unkin.net lmtp:[stalwart.mail.svc.cluster.local]:24
+main.unkin.net lmtp:[stalwart.mail.svc.cluster.local]:24
diff --git a/apps/base/mail/stalwart-configmap.yaml b/apps/base/mail/stalwart-configmap.yaml
index cf485e4..b8da9c9 100644
--- a/apps/base/mail/stalwart-configmap.yaml
+++ b/apps/base/mail/stalwart-configmap.yaml
@@ -1,6 +1,7 @@
 ---
 # config.json only names the datastore; everything else lives in Postgres and
 # is converged from plan.ndjson by the stalwart-apply PostSync Job.
+# The spam filter only scores rspamd's X-Spam header, feeding the native Junk path.
 # The Coordinator uses the plain Redis client: its cluster client never
 # resubscribes once the Valkey node it subscribed on is replaced.
 apiVersion: v1
@@ -12,7 +13,7 @@ data:
   config.json: |
     {"@type":"PostgreSql","host":"stalwart-db-rw.mail.svc","port":5432,"database":"stalwart","authUsername":"stalwart","authSecret":{"@type":"EnvironmentVariable","variableName":"DB_PASSWORD"},"useTls":true}
   plan.ndjson: |
-    {"@type":"upsert","object":"Domain","matchOn":["name"],"value":{"unkin":{"name":"unkin.net","certificateManagement":{"@type":"Manual"},"dkimManagement":{"@type":"Manual"},"dnsManagement":{"@type":"Manual"},"subAddressing":{"@type":"Enabled"}}}}
+    {"@type":"upsert","object":"Domain","matchOn":["name"],"value":{"unkin":{"name":"unkin.net","aliases":{"main.unkin.net":true},"certificateManagement":{"@type":"Manual"},"dkimManagement":{"@type":"Manual"},"dnsManagement":{"@type":"Manual"},"subAddressing":{"@type":"Enabled"}}}}
     {"@type":"upsert","object":"Certificate","matchOn":["certificate"],"value":{"cert":{"certificate":{"@type":"File","filePath":"/etc/stalwart/tls/tls.crt"},"privateKey":{"@type":"File","filePath":"/etc/stalwart/tls/tls.key"}}}}
     {"@type":"upsert","object":"Directory","matchOn":["description"],"value":{"authentik":{"@type":"Oidc","description":"Authentik","issuerUrl":"https://identity.unkin.net/application/o/stalwart/","requireAudience":"stalwart","requireScopes":{},"claimUsername":"preferred_username","usernameDomain":"unkin.net","claimName":"name"}}}
     {"@type":"upsert","object":"Application","matchOn":["description"],"value":{"webui":{"description":"Stalwart Web Interface","resourceUrl":"https://github.com/stalwartlabs/webui/releases/download/v1.0.11/webui.zip","urlPrefix":{"/admin":true,"/account":true},"unpackDirectory":"/var/lib/stalwart/webui","oauthClientId":"stalwart"}}}
@@ -29,7 +30,14 @@ data:
     {"@type":"update","object":"MtaOutboundStrategy","value":{"route":{"match":{"0":{"if":"is_local_domain(rcpt_domain)","then":"'local'"}},"else":"'smarthost'"}}}
     {"@type":"update","object":"MtaStageAuth","value":{"require":{"match":{},"else":"local_port != 25 && local_port != 24"}}}
     {"@type":"update","object":"SenderAuth","value":{"dkimSignDomain":{"match":{},"else":"false"}}}
-    {"@type":"update","object":"SpamSettings","value":{"enable":false,"spamFilterRulesUrl":null}}
+    {"@type":"reconcile","object":"SpamRule","matchOn":["name"],"value":{"rspamd":{"@type":"Header","name":"RSPAMD_SPAM","enable":true,"priority":0,"condition":{"match":{"0":{"if":"name_lower == 'x-spam' && value_lower == 'yes'","then":"'RSPAMD_SPAM'"}},"else":"false"}}}}
+    {"@type":"reconcile","object":"SpamTag","matchOn":["tag"],"value":{"rspamd":{"@type":"Score","tag":"RSPAMD_SPAM","score":10.0}}}
+    {"@type":"destroy","object":"SpamDnsblServer"}
+    {"@type":"destroy","object":"HttpLookup"}
+    {"@type":"destroy","object":"MemoryLookupKey"}
+    {"@type":"update","object":"SpamClassifier","value":{"model":{"@type":"Disabled"}}}
+    {"@type":"update","object":"SpamPyzor","value":{"enable":false}}
+    {"@type":"update","object":"SpamSettings","value":{"enable":true,"spamFilterRulesUrl":null}}
     {"@type":"update","object":"Metrics","value":{"prometheus":{"@type":"Enabled","authSecret":{"@type":"None"}}}}
     {"@type":"update","object":"Http","value":{"allowedEndpoints":{"match":{"0":{"if":"starts_with(path, '/metrics') && local_port != 9090","then":"404"}},"else":"200"}}}
     {"@type":"update","object":"SystemSettings","value":{"defaultHostname":"mail.unkin.net","defaultDomainId":"#unkin","defaultCertificateId":"#cert"}}