diff --git a/config/server/groupware/maddy.nix b/config/server/groupware/maddy.nix
index 13ed95c..02fa60f 100644
--- a/config/server/groupware/maddy.nix
+++ b/config/server/groupware/maddy.nix
@@ -24,6 +24,44 @@ let
       }
     ];
   };
+
+  smtpConfig = ''
+    limits {
+      all rate 25 1s
+    }
+
+    auth &local_authdb
+
+    source $(local_domains) {
+      check {
+        authorize_sender {
+          prepare_email &local_rewrites
+          user_to_email identity
+        }
+      }
+
+      destination postmaster $(local_domains) {
+        deliver_to &local_routing
+      }
+
+      default_destination {
+        modify {
+          dkim $(primary_domain) $(local_domains) default
+        }
+
+        deliver_to &remote_queue
+      }
+    }
+
+    default_source {
+      reject 501 5.1.8 "Non-local sender domain"
+    }
+  '';
+
+  imapConfig = ''
+    auth &local_authdb
+    storage &local_mailboxes
+  '';
 in
 {
   imports = [
@@ -87,7 +125,7 @@ in
       msgpipeline local_routing {
         check {
           rspamd {
-            api_path unix:/run/rspamd/rspamd.sock
+            api_path /run/rspamd/rspamd.sock
           }
         }
 
@@ -134,41 +172,23 @@ in
       }
 
       submission tls://0.0.0.0:465 tcp://0.0.0.0:587 {
-        limits {
-          all rate 25 1s
-        }
-
-        auth &local_authdb
-
-        source $(local_domains) {
-          check {
-            authorize_sender {
-              prepare_email &local_rewrites
-              user_to_email identity
-            }
-          }
-
-          destination postmaster $(local_domains) {
-            deliver_to &local_routing
-          }
-
-          default_destination {
-            modify {
-              dkim $(primary_domain) $(local_domains) default
-            }
+        ${smtpConfig}
+      }
 
-            deliver_to &remote_queue
-          }
-        }
+      submission tcp://127.0.0.1:365 {
+        ${smtpConfig}
 
-        default_source {
-          reject 501 5.1.8 "Non-local sender domain"
-        }
+        insecure_auth yes
       }
 
       imap tls://0.0.0.0:993 tcp://0.0.0.0:143 {
-        auth &local_authdb
-        storage &local_mailboxes
+        ${imapConfig}
+      }
+
+      imap tcp://127.0.0.1:113 {
+        ${imapConfig}
+
+        insecure_auth yes
       }
 
       target.remote outbound_delivery {