anchor.diff:    haveAliases = cfg.postmasterAlias != "" || cfg.rootAlias != "" || cfg.extraAliases != "";
     haveTransport = cfg.transport != "";
     haveVirtual = cfg.virtual != "";
  +
  +  clientAccess =
  +    if (cfg.dnsBlacklistOverrides != "")
  +    then [ "check_client_access hash:/etc/postfix/client_access" ]
  +    else [];
  +
  +  dnsBl =
  +    if (cfg.dnsBlacklists != [])
  +    then [ (concatStringsSep ", " (map (s: "reject_rbl_client " + s) cfg.dnsBlacklists)) ]
  +    else [];
  +
  +  clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
   
     mainCf =
       ''
  
positive.code: 
    aliasesFile = pkgs.writeText "postfix-aliases" aliases;
    virtualFile = pkgs.writeText "postfix-virtual" cfg.virtual;
    mainCfFile = pkgs.writeText "postfix-main.cf" mainCf;
    masterCfFile = pkgs.writeText "postfix-master.cf" masterCf;
    transportFile = pkgs.writeText "postfix-transport" cfg.transport;
  
negative.code:         description = "
            Entries for the transport map, cf. man-page transport(8).
          ";
        };
  
        dnsBlacklists = mkOption {
          default = [];
          type = with types; listOf string;
          description = "dns blacklist servers to use with smtpd_client_restrictions";
        };
  
        dnsBlacklistOverrides = mkOption {
          default = "";
          description = "contents of check_client_access for overriding dnsBlacklists";
        };
  
        extraMasterConf = mkOption {
  