anchor.diff:        (map (s: "reject_rbl_client " + s) cfg.dnsBlacklists);
   
     clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
  +
  +  smtpTlsSecurityLevel = if cfg.useDane then "dane" else "may";
   
     mainCf = let
       escape = replaceStrings ["$"] ["$$"];
  
positive.code:       // optionalAttrs cfg.enableHeaderChecks { header_checks = [ "regexp:/etc/postfix/header_checks" ]; }
        // optionalAttrs (cfg.tlsTrustedAuthorities != "") {
          smtp_tls_CAfile = cfg.tlsTrustedAuthorities;
          smtp_tls_security_level = "may";
        }
        // optionalAttrs (cfg.sslCert != "") {
          smtp_tls_cert_file = cfg.sslCert;
          smtp_tls_key_file = cfg.sslKey;
  
          smtp_tls_security_level = "may";
  
          smtpd_tls_cert_file = cfg.sslCert;
          smtpd_tls_key_file = cfg.sslKey;
  
negative.code:         default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
          description = ''
            File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This basically sets smtp_tls_CAfile and enables opportunistic tls. Defaults to NixOS trusted certification authorities.
          '';
        };
  
        useDane = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Sets smtp_tls_security_level to "dane" rather than "may". See postconf(5) for details.
          '';
        };
  
  