diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
index 5f7821d..0b2c906 100644
--- a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
@@ -16,5 +16,6 @@ resources:
   - identity.yaml
   - lb1.yaml
   - logviewer.yaml
+  - mail.yaml
   - vlogs.yaml
   - watchstate.yaml
diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml
new file mode 100644
index 0000000..142f877
--- /dev/null
+++ b/apps/base/bind-internal/authoritative/unkin-net/a/mail.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: mail-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: mail
+  type: A
+  ttl: 600
+  values:
+    # stalwart-lb PureLB VIP (IMAPS, submission, HTTPS).
+    - 198.18.200.11