diff --git a/systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age b/systems/x86_64-linux/prefect/secrets/stalwart-fallback-admin-pw.age
index c9766487f8aa3087c0e6a0a19cd065487b59291c..798b1cd3288680b3e0e7a8fe93e1be9d407941e0 100644
GIT binary patch
delta 1112
zcmbQr@s(qOPJOU}M^IK_fkl?Tc7(rWhJUD|M?j%}Sa?u@fu%`ms(yHyS!6_By1Q9e
zGFNc1Uy_Mih=)N{dA?V$acZ!(qqb{hVv<o_n0s(&TB2cIMpSW5N|1MCD3`9CLUD11
zZc%ZfLYiA*W{4w~yLmu{k86RknPYjHr?XLTRD?xEM!l(}mxpn_eoj@YOMpvCMqZAA
zbF#lhl%q?wt3hR0d2W<*Wo4FQp}wiVF_(9sn}tVFdVao7g|SI~eqN?~KtVvhucNP5
zNl8|zU#Y8iMR-nWUT#KafxAVfzG+ETRZgX+Pf=1~o@<0<Rx+2bPeEu{UY3`We^hW`
zNM2^1MZIaBX_$FlZcutgMzK$FvcFGZq^ob3rD2sxiEpZtv7djaL8wn=woh<CgrAEq
zSD2BHf0%h%luKfyxwDggSzusFeoCOJyG3BWuTe@-wu!%wvq4EfXtut4u}emBsGFaG
zmr+@OX-cMVL2;#N5|@X0gnq6|QeI(MfLT;<alLk#mqkuuYI#+GZ&I*Vghx<Lm}5?8
zerA!At7C<Kxw&anl0lTQpHWzZUvPGKxR*XxNLHa~Sg3xYx2c=6XJE0VbBUX$k7<Ub
zd$GB;NtC0rN2#&5XP}pRxv_I<QI@NhtA1#(t9yEOmYacTV1#21SEP@diFR;sx}$bw
zc70w%Sdwv2URAbBZh%o?cu{$<XL?nLUw&4JM|P!|VR3P3slG>!TcUokOQlg^N<?m1
zZX%b9UwMv+aiViUkfo!ClTUuRQ>lw<ibbS<Ws0+jqh&^>k$1X#x`}ada%f7SYjH)k
zSH8JXfRBg2MNp1kVQ?y!V`Ng2et3jMV7+NsNvVHnnu(>pd11M~QEq;vpTDtznOlj!
zxno3jXp**fep0eUvPG1CVxWajxPOjWUSMdR8JC-3nt5hgnNdlKn|pR;qDNYqbCHEp
zn6rmTo{3jVRa9b-d2xlmMOmm>Vz9Y$q;|4?K~R3CWniUckbkAQt0R|%Uxss~aea}y
zU$&ulYNofPX-ZUOj&`O=u%m~GYgmqpN0v`okiWKNU|BvaHK(Q+nVK3}DwG%Grg%6i
zM7d=ex|QT)WoHJJxEq;dhE#cZo26x>=IK{B=9oo==;u_0mAM-GX9WdvIYoGyC0k@h
zYFno1Cnp65c_$Y~7#Ta(n_0N#8;2)_c!s3r=2V9G1y_X_aOvvmDpZtYMWtILn<qNu
zIr|#BWV%`e<V5P1RT|}GxVx7I8<r=g6o*@8>!$~}a;@H!@2w)=bEK>DW9HLu#~%0I
zyCUlHX4e+qB1zR9+E#ouXA`oICBB;#!gw|IM4F_{i@CLpJ%P(#%dZS{%&mR(#8xxs
ziHAIM&a78FMw4eupI|Zl>ih@1zazFSxo7Vw-?sJcDXmqTB>h9?P0X}xkJ-I8zOupm
d)Bkr%T72^Fm>Ds1JPuQC*zzX#punPCc>sL3g4F;3

delta 1015
zcmey$F_mM2PJO;nXtBGCSFpB8nOQ-mv#Eujk8zcENN8GMZje`%c7<hPQk9ddN0Lu?
zIajhvPGEXSrJqZdVNp)0L3Tu7iD_U?Ku*3vj-S4(v!}jEMS8Mpa;d9+K9{bYLUD11
zZc%ZfLYiA*W{4wKrelt=hh<8lyLn1+fOCm?YF1QvL4B2*v73okrDd)~aEh;UK~-60
zaIsOjL1BrdYiWLEc|<^zv5TppPq}$;DpyKQghy6skZX9JaY~v?Vve~<WK>34q-mjf
za<-G1r)6M)znNo3RGxRLPgP*5zoB=irK^!ons-u8mRXi|p*xp_rK3}*NvXC;x~rjg
zsHb~zRlQqThHp}FXp)h;nUPD5p;u^SnTxTLftRzRVM%yJO0scTR7sVYN0~{feyM&j
zS7MpDlZSp~X-blhNx8G3Yqqy*X@Hk`xk;LKK$VNOpQp2hv!hS4zma2lNmxj!Po;@=
zo=aXzp=olcv$?5B6<3IFvZteuYml>fN=RX{Q@vY3PP%crxocsuc1UHASz%?Ac14J9
zic^Y7qDN(7QKGh4ex$Kso@s8BQ)Q`hQI0=Xpm|ELTUwB1p0;;bs#|$Tcv*;-Q?S01
zsYy<xWpagUl&`Z<o?)hGiD`*{lx10BPDXN|X@rSWReoTuTX9GpS5RWGzNweHmv2Fo
zcD+TUk$#kSsYgXbo|{LMxnruOi&JK}yLVt<NPd(_RdJ%JdwD>pS!%LRd6K?sh*N=a
zN(q-wiF3NPuX9qKS$3wUp+$*rS#nlsc3EygVX1+eM^cG#Xt|HRuX}!}o4Y}BioUad
zfoDcZXrymdRk}x3NM0^inW<%9W=?iUYQ3YjnPo{)XhE8nabZ-1sb__YSxJh2iGDzC
zSx}^9YHF0Xc5z`?L~x*gWSU2Ak&8!gzJ6g^0hhUJuAg(BcT#DncTtJ2S)yU8dvSnI
zaH@AyYDH+FtFyn8muXVAo40Rda8*=hex{F4c8-NdRbXY2x361CRu-43Ww2q9VZCF7
zg-c>_R&GH>W|6CTdTu~fVOCPEQD}a6s&9o+c)77pURpXVHK(Q+nVK3}DwG%Grg%6i
zxRz_@n`e|8yW|9$CAvoBX9m0J2W5siCs~$S`kSSD_~$1X7E~CexP>Hhd3!{J`zN_a
zRXP^sxcHWPnz>b`S81CSlowa#`Q!wLIVW3&=4BiDTY5OUa_Q>oD&*)_SfnOeSQdn2
znidopS$busm^pc*<s_#DyN2a>1?O27rR15VCi&<2a_Rlt_OeWQ<;mA2xkr~XtUfH$
f!Td65I&(5x9$)>WvSh<gHtT{mZizF0{bnx!I^0x-

diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
index 6e7ed064..686afc60 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/acme.nix
@@ -1,8 +1,10 @@
-{ cfg }:
+# ACME for certs, using TLS-ALPN-01 Challenges(one fewer ports open)
+# https://stalw.art/docs/server/tls/acme/configuration
+{ cfg, sec }:
 {
   letsencrypt = {
     directory = "https://acme-staging-v02.api.letsencrypt.org/directory";
-    challenge = "http-01";
+    challenge = "dns-01";
     contact = [ "pyrox@pyrox.dev" ];
     domains = [
       "mail.pyrox.dev"
@@ -13,5 +15,7 @@
     cache = "${cfg.dataDir}/acme/certs";
     renew-before = "30d";
     default = true;
+    provider = "desec";
+    secret = "%{file:${sec.stalwart-desec-token.path}}";
   };
 }
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
index 86aa61e7..55154f9f 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/default.nix
@@ -28,12 +28,12 @@ in
   services.stalwart-mail = {
     enable = true;
     dataDir = "/var/lib/stalwart";
-    credentials = {
-      rsa_private_key = sec.stalwart-secret-rsa.path;
-      ed25519_private_key = sec.stalwart-secret-ed25519.path;
-    };
     settings = {
       tracer.stdout.level = "debug";
+      authentication.fallback-admin = {
+        user = "fallback";
+        secret = "%{file:${sec.stalwart-fallback-admin-pw.path}}";
+      };
       config = {
         local-keys = [
           "acme.*"
@@ -56,6 +56,7 @@ in
           "resolver.*"
           "server.*"
           "session.*"
+          "signature.*"
           "storage.*"
           "store.*"
           "tracer.*"
@@ -66,9 +67,7 @@ in
         ];
       };
       server = import ./server.nix { inherit d; };
-      # ACME for certs, using TLS-ALPN-01 Challenges(one fewer ports open)
-      # https://stalw.art/docs/server/tls/acme/configuration
-      acme = import ./acme.nix { inherit cfg; };
+      acme = import ./acme.nix { inherit cfg sec; };
       # HTTP Configuration
       # https://stalw.art/docs/http/overview
       http = {
@@ -78,6 +77,8 @@ in
       # Disable HTTP Forms submission
       # https://stalw.art/docs/http/form-submission
       form.enable = false;
+      # DKIM Signatures
+      signature = import ./signature.nix { inherit sec; };
       # Storage Settings
       # https://stalw.art/docs/storage/overview
       store = {
@@ -177,5 +178,11 @@ in
     stalwart-secret-ed25519 = smSecret // {
       file = ../../../secrets/stalwart-secret-ed25519.age;
     };
+    stalwart-desec-token = smSecret // {
+      file = ../../../secrets/stalwart-desec-token.age;
+    };
+    stalwart-fallback-admin-pw = smSecret // {
+      file = ../../../secrets/stalwart-fallback-admin-pw.age;
+    };
   };
 }
diff --git a/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix b/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
index 771b5d20..64529cd7 100644
--- a/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
+++ b/systems/x86_64-linux/prefect/services/mailserver/stalwart/signature.nix
@@ -1,3 +1,4 @@
+{ sec }:
 let
   headers = [
     "From"
@@ -20,7 +21,7 @@ in
 {
   rsa = {
     inherit headers;
-    private-key = "%{file:/run/credentials/stalwart-mail.service/rsa_private_key}";
+    private-key = "%{file:${sec.stalwart-secret-rsa.path}}";
     domain = "pyrox.dev";
     selector = "rsa-default";
     algorithm = "rsa-sha256";
@@ -30,7 +31,7 @@ in
   };
   ed25519 = {
     inherit headers;
-    private-key = "%{file:/run/credentials/stalwart-mail.service/ed25519_private_key}";
+    private-key = "%{file:${sec.stalwart-secret-ed25519.path}}";
     domain = "pyrox.dev";
     selector = "default";
     algorithm = "ed25519-sha256";