diff --git a/bundles/dovecot/files/dovecot-sql.conf b/bundles/dovecot/files/dovecot-sql.conf
index 3f8b39f..12f6707 100644
--- a/bundles/dovecot/files/dovecot-sql.conf
+++ b/bundles/dovecot/files/dovecot-sql.conf
@@ -8,10 +8,3 @@ password_query = SELECT CONCAT(users.name, '@', domains.name) AS user, password\
   WHERE redirect IS NULL \
   AND users.name = SPLIT_PART('%u', '@', 1) \
   AND domains.name = SPLIT_PART('%u', '@', 2)
-
-user_query = SELECT CONCAT(users.name, '@', domains.name) AS user, '/var/vmail/%u' AS home \
-  FROM users \
-  LEFT JOIN domains ON users.domain_id = domains.id \
-  WHERE redirect IS NULL \
-  AND users.name = SPLIT_PART('%u', '@', 1) \
-  AND domains.name = SPLIT_PART('%u', '@', 2)
diff --git a/bundles/dovecot/files/dovecot.conf b/bundles/dovecot/files/dovecot.conf
index 38fc59b..a98359a 100644
--- a/bundles/dovecot/files/dovecot.conf
+++ b/bundles/dovecot/files/dovecot.conf
@@ -1,138 +1,52 @@
-!include conf.d/*.conf
+auth_mechanisms = plain login
+mail_privileged_group = mail
+ssl = required
+ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
+ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
+ssl_dh = </etc/dovecot/dhparam.pem
+ssl_client_ca_dir = /etc/ssl/certs
 
+mail_location = maildir:~/Maildir
 namespace inbox {
-  separator = .
-  type = private
   inbox = yes
-  location =
+  separator = .
   mailbox Drafts {
-    auto = subscribe
     special_use = \Drafts
   }
   mailbox Junk {
-    auto = create
     special_use = \Junk
-    autoexpunge = 30d
-  }
-  mailbox Sent {
-    auto = subscribe
-    special_use = \Sent
   }
   mailbox Trash {
-    auto = subscribe
     special_use = \Trash
-    autoexpunge = 360d
   }
-  prefix =
-}
-
-mail_location = maildir:/var/vmail/%u
-protocols = imap lmtp sieve
-
-ssl = yes
-ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
-ssl_key = </var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
-ssl_dh = </etc/dovecot/ssl/dhparam.pem
-ssl_min_protocol = TLSv1.2
-ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM
-ssl_prefer_server_ciphers = yes
-
-login_greeting = IMAPd ready
-auth_mechanisms = plain login
-disable_plaintext_auth = yes
-mail_plugins = $mail_plugins zlib
-
-plugin {
-   zlib_save_level = 6
-   zlib_save = gz
-
-   sieve_plugins = sieve_imapsieve sieve_extprograms
-   sieve_dir = /var/vmail/sieve/%u/
-   sieve = /var/vmail/sieve/%u.sieve
-   sieve_pipe_bin_dir = /var/vmail/sieve/bin
-   sieve_extensions = +vnd.dovecot.pipe
-
-   old_stats_refresh = 30 secs
-   old_stats_track_cmds = yes
-
-% if node.has_bundle('rspamd'):
-   sieve_before = /var/vmail/sieve/global/spam-global.sieve
-
-   # From elsewhere to Spam folder
-   imapsieve_mailbox1_name = Junk
-   imapsieve_mailbox1_causes = COPY
-   imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve
-
-   # From Spam folder to elsewhere
-   imapsieve_mailbox2_name = *
-   imapsieve_mailbox2_from = Junk
-   imapsieve_mailbox2_causes = COPY
-   imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve
-% endif
-}
-
-service auth {
-   unix_listener /var/spool/postfix/private/auth {
-       mode = 0660
-       user = postfix
-       group = postfix
-   }
-
-   unix_listener auth-userdb {
-       mode = 0660
-       user = nobody
-       group = nogroup
-   }
-}
-
-service lmtp {
-   unix_listener /var/spool/postfix/private/dovecot-lmtp {
-       group = postfix
-       mode = 0600
-       user = postfix
-   }
-}
-
-service imap {
-   executable = imap
-}
-
-service imap-login {
-   service_count = 1
-   process_min_avail = 8
-   vsz_limit = 64M
-}
-
-service managesieve-login {
-   inet_listener sieve {
-       port = 4190
-   }
-}
-
-userdb {
-   driver = sql
-   args = /etc/dovecot/dovecot-sql.conf
+  mailbox Sent {
+    special_use = \Sent
+  }
+  mailbox "Sent Messages" {
+    special_use = \Sent
+  }
 }
 
 passdb {
-   driver = sql
-   args = /etc/dovecot/dovecot-sql.conf
+  driver = sql
+  args = /etc/dovecot/dovecot-sql.conf
+}
+userdb {
+  driver = static
+  args = uid=vmail gid=vmail home=/var/vmail/%u
 }
 
-protocol lmtp {
-   mail_plugins = $mail_plugins sieve
-   postmaster_address = ${admin_email}
+service auth {
+  unix_listener /var/spool/postfix/private/auth {
+    mode = 0660
+    user = postfix
+    group = postfix
+  }
 }
-
-protocol imap {
-   mail_plugins = $mail_plugins imap_zlib imap_sieve imap_old_stats
-   mail_max_userip_connections = 50
-   imap_idle_notify_interval = 29 mins
-}
-
-protocol sieve {
-   plugin {
-       sieve = /var/vmail/sieve/%u.sieve
-       sieve_storage = /var/vmail/sieve/%u/
-   }
+service lmtp {
+  unix_listener /var/spool/postfix/private/dovecot-lmtp {
+    group = postfix
+    mode = 0600
+    user = postfix
+  }
 }
diff --git a/bundles/dovecot/items.py b/bundles/dovecot/items.py
index b7b598d..5738cf0 100644
--- a/bundles/dovecot/items.py
+++ b/bundles/dovecot/items.py
@@ -1,6 +1,9 @@
 assert node.has_bundle('mailserver')
 
 directories = {
+    '/etc/dovecot': {
+        'purge': True,
+    },
     '/etc/dovecot/ssl': {},
     '/var/vmail': {
         'owner': 'vmail',
@@ -8,17 +11,14 @@ directories = {
     }
 }
 
-# groups['vmail'] = {
-#     'gid': 5000,
-# }
-# 
-# users['vmail'] = {
-#     'uid': 5000,
-#     'home': '/var/vmail',
-#     'needs': [
-#         'group:vmail',
-#     ]
-# }
+groups['vmail'] = {}
+
+users['vmail'] = {
+    'home': '/var/vmail',
+    'needs': [
+        'group:vmail',
+    ]
+}
 
 files = {
     '/etc/dovecot/dovecot.conf': {
@@ -43,15 +43,19 @@ files = {
             'svc_systemd:dovecot:restart',
         },
     },
+    '/etc/dovecot/dhparam.pem': {
+        'content_type': 'any',
+    },
 }
 
 actions = {
     'dovecot_generate_dhparam': {
-        'command': 'openssl dhparam -out /etc/dovecot/ssl/dhparam.pem 2048',
-        'unless': 'test -f /etc/dovecot/ssl/dhparam.pem',
+        'command': 'openssl dhparam -out /etc/dovecot/dhparam.pem 2048',
+        'unless': 'test -f /etc/dovecot/dhparam.pem',
         'cascade_skip': False,
         'needs': {
-            'pkg_apt:'
+            'pkg_apt:',
+            'directory:/etc/dovecot/ssl',
         },
         'triggers': {
             'svc_systemd:dovecot:restart',
diff --git a/bundles/dovecot/metadata.py b/bundles/dovecot/metadata.py
index 09810fd..cc921f3 100644
--- a/bundles/dovecot/metadata.py
+++ b/bundles/dovecot/metadata.py
@@ -4,10 +4,10 @@ defaults = {
     'apt': {
         'packages': {
             'dovecot-imapd': {},
-            'dovecot-lmtpd': {},
-            'dovecot-managesieved': {},
             'dovecot-pgsql': {},
-            'dovecot-sieve': {},
+            'dovecot-lmtpd': {},
+#            'dovecot-sieve': {},
+#            'dovecot-managesieved': {},
         },
     },
     'letsencrypt': {
diff --git a/bundles/mailserver/metadata.py b/bundles/mailserver/metadata.py
index b338f73..fe73dba 100644
--- a/bundles/mailserver/metadata.py
+++ b/bundles/mailserver/metadata.py
@@ -4,7 +4,7 @@ defaults = {
     'mailserver': {
         'maildir': '/var/vmail',
         'database': {
-            'host': 'localhost',
+            'host': '127.0.0.1', # dont use localhost
             'name': 'mailserver',
             'user': 'mailserver',
             'password': database_password,
diff --git a/bundles/postfix/files/main.cf b/bundles/postfix/files/main.cf
index 96a6ec8..b405ed0 100644
--- a/bundles/postfix/files/main.cf
+++ b/bundles/postfix/files/main.cf
@@ -1,63 +1,39 @@
-# See /usr/share/postfix/main.cf.dist for a commented, more complete version
-
-
-# Debian specific:  Specifying a file name will cause the first
-# line of that file to be used as the name.  The Debian default
-# is /etc/mailname.
-#myorigin = /etc/mailname
-
 smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
 biff = no
-
-# appending .domain is the MUA's job.
 append_dot_mydomain = no
-
-# Uncomment the next line to generate "delayed mail" warnings
-#delay_warning_time = 4h
-
 readme_directory = no
-
-# TLS parameters
-smtpd_tls_cert_file = /etc/letsencrypt/live/mail.sublimity.de/fullchain.pem
-smtpd_tls_key_file = /etc/letsencrypt/live/mail.sublimity.de/privkey.pem
+compatibility_level = 2
 smtpd_use_tls=yes
 <%text>
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
 </%text>
-
-# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
-# information on enabling SSL in the smtp client.
-
 smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
-myhostname = mail.sublimity.de
+myhostname = debian-2gb-nbg1-1
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
 myorigin = /etc/mailname
-mydestination = mail.sublimity.de, localhost.localdomain, localhost
+mydestination = $myhostname, mail2.sublimity.de, debian-2gb-nbg1-1, localhost.localdomain, localhost
 relayhost =
 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
 mailbox_size_limit = 0
 recipient_delimiter = +
 inet_interfaces = all
 inet_protocols = all
-virtual_mailbox_domains = psql:/etc/postfix/virtual_domains.cf
-virtual_mailbox_maps = psql:/etc/postfix/virtual_mailboxes.cf
-virtual_alias_maps = psql:/etc/postfix/virtual_aliases.cf,psql:/etc/postfix/virtual_mailboxes.cf
+
+virtual_mailbox_domains = pgsql:/etc/postfix/virtual_mailbox_domains.cf
+virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
+virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
+virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf,pgsql:/etc/postfix/virtual_mailbox_maps.cf
+smtpd_sender_login_maps = pgsql:/etc/postfix/email2email.cf
 virtual_transport = lmtp:unix:private/dovecot-lmtp
+
 smtpd_sasl_type = dovecot
 smtpd_sasl_path = private/auth
 smtpd_sasl_auth_enable = yes
+
 smtpd_tls_security_level = may
 smtpd_tls_auth_only = yes
-message_size_limit = 1000000000
-smtpd_milters = unix:/spamass/spamass.sock
-milter_connect_macros = i j {daemon_name} v {if_name} _
-policyd-spf_time_limit = 3600
-
-smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,check_policy_service unix:private/policyd-spf
-#  reject_rbl_client dnsbl.sorbs.net
-#  reject_rbl_client bl.spamcop.net
-#  reject_rbl_client zen.spamhaus.org
-#  reject_rbl_client dnsbl1.uceprotect.net
-#  reject_unauth_destination
+smtpd_tls_cert_file = /var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/fullchain.pem
+smtpd_tls_key_file = /var/lib/dehydrated/certs/${node.metadata.get('mailserver/hostname')}/privkey.pem
+smtp_tls_security_level = may
diff --git a/bundles/postfix/files/master.cf b/bundles/postfix/files/master.cf
index 3ad0e3d..f9d8b21 100644
--- a/bundles/postfix/files/master.cf
+++ b/bundles/postfix/files/master.cf
@@ -1,124 +1,37 @@
-#
-# Postfix master process configuration file.  For details on the format
-# of the file, see the master(5) manual page (command: "man 5 master" or
-# on-line: http://www.postfix.org/master.5.html).
-#
-# Do not forget to execute "postfix reload" after editing this file.
-#
 # ==========================================================================
 # service type  private unpriv  chroot  wakeup  maxproc command + args
-#               (yes)   (yes)   (yes)   (never) (100)
+#               (yes)   (yes)   (no)    (never) (100)
 # ==========================================================================
-smtp      inet  n       -       -       -       -       smtpd
-#smtp      inet  n       -       -       -       1       postscreen
-#smtpd     pass  -       -       -       -       -       smtpd
-#dnsblog   unix  -       -       -       -       0       dnsblog
-#tlsproxy  unix  -       -       -       -       0       tlsproxy
-#submission inet n       -       -       -       -       smtpd
-#  -o syslog_name=postfix/submission
-#  -o smtpd_tls_security_level=encrypt
-#  -o smtpd_sasl_auth_enable=yes
-#  -o smtpd_reject_unlisted_recipient=no
-#  -o smtpd_client_restrictions=$mua_client_restrictions
-#  -o smtpd_helo_restrictions=$mua_helo_restrictions
-#  -o smtpd_sender_restrictions=$mua_sender_restrictions
-#  -o smtpd_recipient_restrictions=
-#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-#  -o milter_macro_daemon_name=ORIGINATING
-
-submission inet n       -       -       -       -       smtpd
-  -o syslog_name=postfix/submission
-  -o smtpd_tls_security_level=encrypt
-  -o smtpd_sasl_auth_enable=yes
-  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
-
-#smtps     inet  n       -       -       -       -       smtpd
-#  -o syslog_name=postfix/smtps
-#  -o smtpd_tls_wrappermode=yes
-#  -o smtpd_sasl_auth_enable=yes
-#  -o smtpd_reject_unlisted_recipient=no
-#  -o smtpd_client_restrictions=$mua_client_restrictions
-#  -o smtpd_helo_restrictions=$mua_helo_restrictions
-#  -o smtpd_sender_restrictions=$mua_sender_restrictions
-#  -o smtpd_recipient_restrictions=
-#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-#  -o milter_macro_daemon_name=ORIGINATING
-#628       inet  n       -       -       -       -       qmqpd
-pickup    unix  n       -       -       60      1       pickup
-cleanup   unix  n       -       -       -       0       cleanup
+smtp      inet  n       -       y       -       -       smtpd
+pickup    unix  n       -       y       60      1       pickup
+cleanup   unix  n       -       y       -       0       cleanup
 qmgr      unix  n       -       n       300     1       qmgr
-#qmgr     unix  n       -       n       300     1       oqmgr
-tlsmgr    unix  -       -       -       1000?   1       tlsmgr
-rewrite   unix  -       -       -       -       -       trivial-rewrite
-bounce    unix  -       -       -       -       0       bounce
-defer     unix  -       -       -       -       0       bounce
-trace     unix  -       -       -       -       0       bounce
-verify    unix  -       -       -       -       1       verify
-flush     unix  n       -       -       1000?   0       flush
+tlsmgr    unix  -       -       y       1000?   1       tlsmgr
+rewrite   unix  -       -       y       -       -       trivial-rewrite
+bounce    unix  -       -       y       -       0       bounce
+defer     unix  -       -       y       -       0       bounce
+trace     unix  -       -       y       -       0       bounce
+verify    unix  -       -       y       -       1       verify
+flush     unix  n       -       y       1000?   0       flush
 proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
-smtp      unix  -       -       -       -       -       smtp
-relay     unix  -       -       -       -       -       smtp
-#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
-showq     unix  n       -       -       -       -       showq
-error     unix  -       -       -       -       -       error
-retry     unix  -       -       -       -       -       error
-discard   unix  -       -       -       -       -       discard
+smtp      unix  -       -       y       -       -       smtp
+relay     unix  -       -       y       -       -       smtp
+        -o syslog_name=postfix/$service_name
+showq     unix  n       -       y       -       -       showq
+error     unix  -       -       y       -       -       error
+retry     unix  -       -       y       -       -       error
+discard   unix  -       -       y       -       -       discard
 local     unix  -       n       n       -       -       local
 virtual   unix  -       n       n       -       -       virtual
-lmtp      unix  -       -       -       -       -       lmtp
-anvil     unix  -       -       -       -       1       anvil
-scache    unix  -       -       -       -       1       scache
-#
-# ====================================================================
-# Interfaces to non-Postfix software. Be sure to examine the manual
-# pages of the non-Postfix software to find out what options it wants.
-#
-# Many of the following services use the Postfix pipe(8) delivery
-# agent.  See the pipe(8) man page for information about ${recipient}
-# and other message envelope options.
-# ====================================================================
-#
-# maildrop. See the Postfix MAILDROP_README file for details.
-# Also specify in main.cf: maildrop_destination_recipient_limit=1
-#
+lmtp      unix  -       -       y       -       -       lmtp
+anvil     unix  -       -       y       -       1       anvil
+scache    unix  -       -       y       -       1       scache
+postlog   unix-dgram n  -       n       -       1       postlogd
 maildrop  unix  -       n       n       -       -       pipe
   flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
-#
-# ====================================================================
-#
-# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
-#
-# Specify in cyrus.conf:
-#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
-#
-# Specify in main.cf one or more of the following:
-#  mailbox_transport = lmtp:inet:localhost
-#  virtual_transport = lmtp:inet:localhost
-#
-# ====================================================================
-#
-# Cyrus 2.1.5 (Amos Gouaux)
-# Also specify in main.cf: cyrus_destination_recipient_limit=1
-#
-#cyrus     unix  -       n       n       -       -       pipe
-#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
-#
-# ====================================================================
-# Old example of delivery via Cyrus.
-#
-#old-cyrus unix  -       n       n       -       -       pipe
-#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
-#
-# ====================================================================
-#
-# See the Postfix UUCP_README file for configuration details.
-#
 uucp      unix  -       n       n       -       -       pipe
   flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
-#
-# Other external delivery methods.
-#
 ifmail    unix  -       n       n       -       -       pipe
   flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
 bsmtp     unix  -       n       n       -       -       pipe
@@ -128,5 +41,15 @@ scalemail-backend unix	-	n	n	-	2	pipe
 mailman   unix  -       n       n       -       -       pipe
   flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
   ${nexthop} ${user}
-policyd-spf  unix  -       n       n       -       0       spawn
-    user=policyd-spf argv=/usr/bin/policyd-spf
+submission inet n       -       y       -       -       smtpd
+   -o syslog_name=postfix/submission
+   -o smtpd_tls_security_level=encrypt
+   -o smtpd_sasl_auth_enable=yes
+   -o smtpd_tls_auth_only=yes
+   -o smtpd_reject_unlisted_recipient=no
+   -o smtpd_client_restrictions=$mua_client_restrictions
+   -o smtpd_helo_restrictions=$mua_helo_restrictions
+   -o smtpd_sender_restrictions=$mua_sender_restrictions
+   -o smtpd_recipient_restrictions=
+   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+   -o milter_macro_daemon_name=ORIGINATING